Security approach
What we actually do, described at a level that is useful to a security reviewer without publishing anything that makes an attack easier.
Our position, stated plainly
ASTRI DEVS LTD does not hold Cyber Essentials, Cyber Essentials Plus, ISO 27001, SOC 2 or any equivalent certification, and does not claim to. Our controls are designed with established security principles in mind, and we would rather describe them accurately than imply an accreditation we have not been through.
Where a procurement requires certification, tell us at the outset. We will confirm whether we can obtain it within your timescale, or withdraw. Supplier security questionnaires are completed properly as part of procurement — against your questions, about the specific engagement, rather than by attaching a generic statement.
Secure development
- Dependencies are tracked, kept current and audited for known vulnerabilities as part of the build rather than on an ad-hoc basis.
- Secrets are held in the deployment platform’s secret storage and injected as environment variables. Credentials are not committed to source control.
- Changes are reviewed before they reach a shared branch, and automated checks — type checking, linting, tests, accessibility checks — run on every change.
- Development, staging and production are separated, with separate credentials and separate data. Production data is not copied into development environments.
- Configuration is defined in code where the platform allows it, so an environment can be rebuilt rather than reconstructed from memory.
Data protection in system design
- What personal data a system will hold, why, and for how long is established during design rather than discovered during a data protection impact assessment.
- Systems are designed to collect the minimum needed for the purpose. Fields that exist only because they might be useful later are the ones that appear in breach notifications.
- Where a system processes personal data on behalf of a client, the client remains the controller and the processing terms are written into the contract.
- Retention and deletion are treated as functional requirements with an owner, not as a policy statement with no implementation.
Access control
- Access is granted on a least-privilege basis: the minimum needed to do the work, for the period the work runs.
- Access to client systems is granted by the client, through the client’s own process, and is removed at the end of an engagement.
- Administrative accounts use multi-factor authentication.
- Access to production environments is separated from routine development access.
Encryption
- Data in transit is protected with TLS. This website is served over HTTPS with HTTP Strict Transport Security.
- Where a system stores data, encryption at rest is provided by the managed database or storage service in use, and the position is confirmed per engagement rather than assumed.
- Encryption claims for a specific client system are answered against that system, not against a generic statement on a website.
This website
- The site is a static build. There is no content management system, no database and no administrative login to attack.
- A Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame-ancestors restrictions are applied to responses.
- Fonts are self-hosted. No third-party script, tag manager, analytics product or advertising pixel is loaded.
- The contact form validates on the server, applies rate limiting, and is protected against automated submission without a CAPTCHA.
Reporting a vulnerability
If you have found a security issue in this website or in a system we operate, we want to hear about it. Our responsible disclosure policy explains how to report it and what to expect. Reports go to info@astridevs.co.uk.
A machine-readable version is published at /.well-known/security.txt following RFC 9116.
Need a security questionnaire completed?
Send it with the procurement reference and the deadline. Security questions get answered against the engagement rather than in general terms.