Security & trust

Our controls as a supplier

Least privilege. We ask only for the access a task needs, for as long as it needs it. Where possible, we work through your Git repositories and pipeline rather than directly on servers.

Per-repository, read-only deploy keys. A server that pulls code gets a key for one repository, and that key cannot write.

CI keys pinned to a forced command. The keys our pipelines use to deploy can run one command only. A leaked CI key can redeploy the approved code, nothing else.

SSH by key only. Password logins are disabled on servers we manage, and FTP is removed.

Backups with tested restores. Backups are encrypted and stored separately from the systems they protect. We restore them and verify the result by checksum, because an untested backup is a hope, not a control.

Changes only through Git and pull requests. Every change is reviewed, checked and traceable. Production deploys go through a gate on the server that a pull request cannot weaken. See How we work for the full list of delivery controls.

Sanitised staging data. Test environments run on a sanitised copy of production: payments, analytics, email and social login are off, and domains are rewritten.

AI agents without access. We use AI agents (Claude) in our work, only through pull requests. They never have server, database or secret access.

No client data kept after engagements. When the work ends, we delete working copies and hand back or revoke access.

NDAs on request, signed before you share anything sensitive.

Our own website. This site uses no cookies and no third-party trackers. Our analytics is self-hosted and cookie-free (Umami), and fonts are served from our own server.

How we handle your credentials

• Rotation at the start and at the end. When we take over access, we ask you to rotate shared credentials, or we rotate them with you. When we finish, every credential we used is rotated or revoked.
• Stored in a password manager, never in plain files, code, email or notes.
• No secrets in chat or tickets. Please do not send passwords by email, chat or issue trackers. We will agree a secure way to share them.

Responsible disclosure

If you believe you have found a security vulnerability in our website or in a system we operate, please email hello@systemflare.com with SECURITY in the subject line.

• Describe the issue and how to reproduce it.
• Do not access, change or delete data that is not yours, and do not degrade the service.
• Give us reasonable time to fix the issue before you disclose it publicly.

We acknowledge reports within 2 business days and keep you informed as we work on a fix.

Supplier questionnaires

Banks, insurers, payment companies and other regulated clients often need to assess us under DORA or NIS2. We answer supplier questionnaires on request, for the specific engagement, and we say clearly where something is not in place rather than ticking every box.

What we do not claim:

• We are not ISO 27001 or SOC 2 certified.
• We implement controls for PCI DSS, DORA and NIS2, but we are not a QSA, not an accredited TLPT provider, and we do not certify anyone.