How we protect the applications we build and run for you, and the data inside them.
Only the two of us, Micah and Michael. We use no subcontractors or offshore staff. Each application gets its own credentials and narrowly scoped AWS IAM access; we never share root keys. When an engagement ends, we revoke our access and hand back or rotate every credential.
Every service that supports multi-factor authentication has it turned on, and our most critical accounts require hardware security keys. Passwords are unique and generated by a password manager. Our servers accept SSH keys only, never passwords. Our work machines use full-disk encryption, install security updates automatically, and lock when idle.
Client applications run on Amazon Web Services behind Cloudflare, which terminates TLS and absorbs DDoS attacks. Every application is HTTPS-only with HSTS. Production databases and storage volumes are encrypted at rest.
Databases and uploaded files are backed up automatically every day to Amazon S3, kept apart from the production servers and encrypted at rest. We restore from these backups routinely in our day-to-day work, so we know they work.
Dependabot proposes dependency updates weekly, and each one must pass the application's full test suite in CI before it ships. Critical security advisories in Ruby, Rails, and their libraries are patched within days, outside the regular schedule. We keep applications on supported Ruby and Rails versions, and server operating-system security updates are applied automatically.
Debugging sometimes requires a copy of production data on our encrypted development machines. Those copies are deleted automatically within one week. Particularly sensitive data is anonymized before it leaves production.
Application errors are reported to Sentry and triaged by us directly. External uptime monitoring alerts us when an application stops responding.
Outgoing email is authenticated with SPF, DKIM, and a DMARC policy of p=reject, so receiving mail servers reject forged messages, and real email lands in inboxes, not spam.
If we confirm a security incident affecting your application or data, we will notify you directly within 24 hours, tell you what we know, and keep you updated until it is resolved.
As a two-person studio we don't hold SOC 2 or ISO 27001 certification. However, we're happy to fill out your security questionnaire or review your data processing agreement.
Email security@botandrose.com. It goes straight to Micah.