Start a project

Services / 08

Security & Governance

DevSecOps, manual code audits, row-level security and multi-tenant data governance, practised on the platforms we build and maintained long after launch.

Start a project All services
A sealed sphere of dark cast iron with a single hairline seam resting on white powder

What it is

Security is engineering time.

For us, security and governance mean that access rules, data handling and code quality are engineered and reviewed, never assumed. Who can see and change each record is defined in the data layer, code is audited by hand before release, and compliance requirements become controls that can be inspected. Our practice describes engineering work, not certification: we build and review the controls enterprise platforms depend on, and keep doing it after launch.

What we do.

The discipline behind the interface, practised on every platform we build.

  • Manual code audits.

    Engineers review business logic, dependencies and every path to the data by hand, alongside automated checks.

  • DevSecOps.

    Security checks built into how code is written, reviewed, released and maintained.

  • Row-level security.

    Access defined per record, per role and per organisation, and enforced where the data lives.

  • Multi-tenant governance.

    Clear boundaries between the organisations sharing a platform, reviewed as the platform grows.

  • Compliance by design.

    Obligations translated into access controls, data-handling rules and reviewable engineering practice, scoped to each organisation.

Intelligence, built in

Governance for AI and agents.

Bringing intelligence into a system raises the stakes for access and accountability. We apply the same security practice to every model and agent we deploy.

Agents with boundaries

Agents act only through defined tools, under the same row-level and role permissions as the people they serve.

Data kept in scope

Data used for AI stays within agreed boundaries, with private training and deployment on our own hardware when the data calls for it.

Every action auditable

Prompts, tool calls and decisions are logged and reviewable, with human approval where the stakes require it.

How we work

Four stages.

  1. Assess

    Map the data, the users, the obligations and the ways the system could be misused.

  2. Design controls

    Permissions, tenancy and data-handling rules designed into the architecture.

  3. Build and audit

    Secure defaults in code, automated checks in the pipeline and manual audits before release.

  4. Review continuously

    Access rules and dependencies reviewed as the platform and its users change.

Scope

What you get.

Deliverables

  1. Security architecture
  2. Row-level security
  3. Multi-tenant data governance
  4. Role & permission design
  5. Manual code audits
  6. Dependency review
  7. DevSecOps pipelines
  8. Compliance mapping
  9. AI & agent governance

Practice

  • Manual code audits
  • DevSecOps
  • Row-level security
  • Multi-tenant governance

Sectors

  • Banking & insurance
  • Healthcare
  • Public sector
  • SaaS
  • Shipping & maritime

Questions

Asked and answered.

Do you audit code by hand?

Yes. Manual code auditing takes a substantial share of our engineering time, alongside automated tooling.

How do you secure AI agents?

Agents act only through defined tools, under the same row-level and role permissions as people, with every action logged and human approval where the stakes require it.

How is data separated between organisations on one platform?

Through strict row-level security and multi-tenant data governance in the data layer, so separation never depends on the interface behaving correctly.

Can you meet our compliance requirements?

We translate your obligations into architecture, access controls and reviewable practices, scoped to your organisation. We describe our work plainly and do not claim blanket compliance on your behalf.

Does security stop at launch?

No. Dependencies, access rules and code are reviewed as the platform evolves, as part of ongoing support.

More services

The rest of the house.

  1. 01

    Enterprise Platforms & Portals

    Customer portals, partner platforms, multi-tenant SaaS and the internal systems behind them.
  2. 02

    CRM & ERP Systems

    Custom CRM, ERP and operations software: customers, orders, assets, fleets and reporting in one system.
  3. 03

    AI & Custom Models

    LLM fine-tuning, domain and speech models, evaluation, private deployment and AI inside real products.
  4. 04

    Transactional Systems

    Leasing platforms, booking engines, quoting, applications, payments and commerce.
  5. 05

    Product & Experience Design

    UX research, information architecture, UI design, prototyping and design systems for complex software.
  6. 06

    Brand & Identity

    Positioning, naming, visual identity and brand systems that carry into products and websites.
  7. 07

    Immersive Web & 3D

    WebGL and Three.js websites, real-time 3D, product visualisation and 3D production.
Five silver folds opening and closing in perspective

Trust Security & governance Takes work