Security

We build software for businesses that can't afford to get security wrong, and we run our own systems the same way.

Your client portal

• You only ever see your own projects, files, quotes and invoices. This is enforced in the code and checked by automated tests on every change.
• Passwords are stored as one-way hashes, never in readable form.
• Files are stored privately and downloaded only through short-lived links that check you're allowed to see them.
• Sensitive details, such as bank details and private notes, are encrypted in the database.
• The site is served only over HTTPS and sits behind Cloudflare, which filters attacks and spam.

Our side

• Every Devmastr admin account uses two-step sign-in.
• Important changes are recorded in an audit log: who changed what, and when.
• The database is backed up nightly. Daily copies are kept for about two weeks and weekly copies for two months.

The systems we build for you

The same standards: least access, encrypted secrets, backups you can restore, and updates kept current on a care plan. Your code, data and infrastructure accounts are in your name, not ours.

Found a problem?

If you think you've found a security issue in our site or anything we've built, email [email protected] before telling anyone else. We'll reply within 2 business days and keep you updated while we fix it. We don't run a paid bug bounty, and we won't pursue anyone who reports in good faith and doesn't access other people's data.