We sell security,
so we practise it.
How we handle your systems, your data and your access, written down so you can hold us to it.
Last updated 9 October 2026
01 Your data stays separate
Every client record in our systems carries the client it belongs to, and every query filters by it. One client can never see another's projects, tickets, messages or invoices.
02 Access
Only staff who work on your project use your systems. Access you give us is used for the job and handed back or removed at the end. We never ask for your password by email or chat.
03 Passwords and payments
Passwords are stored only as strong one-way hashes. Card payments are handled by Stripe or Paddle; card numbers never reach our servers. Payment notifications are checked with the provider's signature before we trust them.
04 Encryption
Everything between your browser and our servers travels over TLS.
05 How we write software
Every change is reviewed, and checked automatically for code errors, leaked secrets and known vulnerable dependencies before it ships. Every input from outside is validated.
06 If something goes wrong
If a security incident affects your data, we tell you what happened, what it touched and what we are doing about it, as soon as we know, and we keep you informed until it is closed.
07 Found a problem?
Please tell us through the vulnerability disclosure page, or write to security@segfaultsec.org.