Monitored After Launch
Care Plan sites get uptime monitoring and dependency vulnerability alerts, with patches applied in business hours.
Professional security standards
Security & compliance
What we build to, how we test it, and what we do not claim. Every control below is listed in the Controls Map.
Security-First Approach
Security isn't an afterthought—it's built into every aspect of our development process and operational procedures.
Least Privilege
Every account and service gets only the access its job needs, and every API request is checked for authorisation.
Mapped to Standards
Built to OWASP ASVS Level 2, ISO 27002 control families, and UK GDPR Articles 25 and 32. See our Controls Map for the specific control IDs.
Security Measures
The controls we put in every build. The Controls Map gives the specific control IDs.
Data Encryption
Encryption for data in transit and at rest
- TLS for all network traffic
- Stored data encrypted at rest by the hosting and database provider
- Secrets held in the hosting platform's encrypted store, never in code
- Keys and credentials kept out of source control
Access Controls
Multi-layered access controls ensuring only authorised personnel can access systems and data
- Role-based access control (RBAC)
- Principle of least privilege
- Authorisation checked on every API endpoint
- Access removed when a project or engagement ends
Infrastructure Security
Hosting in your own cloud account, configured to the provider's security guidance
- Deployed to your Vercel, Cloudflare or AWS account
- HTTPS everywhere, with security headers set
- DDoS protection from the hosting platform
- Uptime and dependency alerts on Care Plan sites
Data Protection
Comprehensive data protection measures built around UK GDPR Articles 25 and 32 and the Data Protection Act 2018
- Data minimisation principles
- Retention periods set for each kind of data
- Secure data backup and recovery
- Data pseudonymisation where appropriate
Sessions and Audit
Sign-in sessions that expire and are re-checked, with a record of administrative actions
- Sessions re-checked against the account whenever the server reads them
- Session expiry and sign-out controls
- Audit logging of administrative actions
- Passwords stored as salted hashes, never in plain text
Application Security
Secure development practices and security testing throughout the development lifecycle
- OWASP Top 10 and ASVS Level 2 controls
- Type checks, linting and automated tests before every release
- Dependency vulnerability scanning
- Penetration-tested before launch, in house
Testing and Certification
We penetration-test what we build before launch, in house. We are not an accredited testing firm; an independent test can be arranged.
Built to Published Standards
OWASP ASVS Level 2, the OWASP Top 10 and ISO 27002 control families, listed control by control in the Controls Map
Penetration Testing
We penetration-test what we build before launch, in house. We are not an accredited testing firm; an independent test can be arranged.
No Certification Claimed
We hold no ISO 27001 or Cyber Essentials certificate today. The Controls Map says what we do instead.
Incident Response Process
What happens if something goes wrong, in the order we do it.
Detection & Analysis
Identification and assessment of the incident from monitoring alerts and reports
Containment
Swift isolation of affected systems to prevent further compromise while maintaining business continuity
Eradication
Complete removal of threats and vulnerabilities from all affected systems and networks
Recovery
Careful restoration of services with enhanced monitoring to ensure systems are clean and secure
Lessons Learned
A written post-incident review, shared with you, and the fixes that stop it happening again
Security Resources
Learn more about our security practices and how we protect your business.
Report a Security Vulnerability
We take security seriously and appreciate responsible disclosure of potential vulnerabilities.
Reporting Process
- Email detailed findings to security@bytebridges.co.uk
- Avoid accessing or modifying user data
- Allow reasonable time for investigation
- Receive acknowledgement within 24 hours on working days
Contact Information
- Security email
- security@bytebridges.co.uk
- Response Time
- Acknowledgement within 24 hours on working days, initial assessment within 5 working days