Scope and evidence / 04
Security and data protection.
Security is a property of the system, not a sentence in the footer. The useful work is finding the boundary and making it real.
Overview
Logins, payments, private data, and the permissions around them. We look for weak points before someone else does.
01 / The fit
Who it is for
- A product holding customer records, credentials, payments, or private files.
- A team facing a security questionnaire, an audit, or a serious incident.
- A founder who wants a security review before the product reaches more people.
02 / The work
What the work covers
- Authentication, session, and access-control review.
- A threat model tied to the real data and the real users.
- Encryption and key-handling review, including the places keys should not go.
- API, form, and upload hardening.
- A practical remediation plan ordered by risk and effort.
- A review record that a client, auditor, or technical team can follow.
03 / The shape
How it runs
- 01
Map
We identify the assets, the trust boundaries, and the paths that can reach them.
- 02
Test
We review the design and the implementation, then verify the important controls rather than trusting the diagram.
- 03
Fix
We rank the findings, fix what is in scope, and leave the evidence and the remaining risk clear.
04 / The proof
Where this shows up
06 / Questions
Questions we hear.
Can you help with a security questionnaire?
Yes. We can review the answers against the actual system, fill technical sections, and mark what is not yet true. We do not sign a claim the system cannot support.
Do you do penetration tests?
We do authorized application security reviews and targeted testing. If a formal third-party penetration test is required, we can prepare the system and help interpret the report.
Will you work with our lawyer or auditor?
Yes. We keep the technical evidence separate from the legal conclusion and can provide the system facts they need.