Risk Management. We identify risks to our information assets, score them on likelihood and impact, and treat them through a formal cycle of mitigation, acceptance, transfer, or avoidance.

Compliance. We comply with the legal, regulatory, and contractual requirements that apply to us, including GDPR. Internal and external audits, plus regular management reviews, keep the ISMS under scrutiny.

Asset Management. Every information asset is identified, classified by sensitivity, and tracked through its full lifecycle, from creation to secure disposal.

Access Management. We grant access on the principle of least privilege. Single sign-on and multi-factor authentication are enforced on every account that handles confidential or internal data, and we review access at least once a year.

Incident Management. We have a documented incident response process that covers detection, classification, containment, resolution, and post-incident review. Suspected incidents can be reported to security@codeandco.com.

Business Continuity. Our Business Continuity and Disaster Recovery plans keep critical functions running through disruption. We test them at least once a year.

Backup Management. We back up critical data, systems, and configurations on a regular schedule. Backups are encrypted, stored securely, and tested at least once a year to confirm they can be restored.

Logging & Monitoring. Critical systems write protected security logs. Automated monitoring flags anomalies and suspicious activity. We review and retain logs in line with business and regulatory requirements.

Patch & Vulnerability Management. We use continuous scanning to surface vulnerabilities, and remediate them against defined SLAs based on severity.

Personnel Security. Every employee and contractor goes through a standard onboarding and offboarding process, signs a confidentiality agreement, and completes mandatory security awareness training each year. Background screening is part of onboarding where appropriate.

Vendor Management. Every vendor with access to our data is risk-assessed when we onboard them, and reassessed on an ongoing basis. Contracts include explicit security and incident-reporting obligations.

Physical Security. We're a fully remote company with no shared office or on-premise infrastructure. Our physical controls focus on home-working environments and on protecting company-issued laptops and devices.

Device Management. All company devices are centrally managed, with full-disk encryption, endpoint detection and response, automatic operating-system updates, screen-lock policies, and remote-wipe capability. Staff with ongoing access to confidential data are not allowed to use personal devices for work.

Secure Software Development. Security is built into every stage of our development process. That covers separated development and production environments, automated static analysis, dependency scanning, and mandatory human code review before anything is merged.

Network Security & Cryptography. Production network traffic runs over an encrypted private mesh (WireGuard). Public traffic is terminated over TLS 1.2 or higher. Confidential data is encrypted at rest and in transit.