Least-privilege access
We ask for the narrowest access that lets the work happen: read only for audits, scoped API tokens or private apps for integrations, and named accounts rather than shared logins. Access is requested in writing, listed in the project documentation, and revoked when the engagement ends.
Credentials in a vault
Client credentials, API keys and tokens are stored in an encrypted password vault, never in email, chat, source code or spreadsheets. Secrets used by a deployed system live in the secret manager of your own hosting account.
NDA by default
We sign a standard mutual NDA before any access is granted, and we will review yours if you prefer it. Everything we see inside your systems is confidential, and we do not publish client names, logos or results without written permission.
Code in your repository
Source code is committed to a repository you own from the first day of the build, not handed over at the end. You control who has access to it, and your history shows every change.
Infrastructure in your accounts
Hosting, databases, queues and third-party services run under your accounts and your billing. We work inside them with the access you grant, so nothing you depend on sits in an account you cannot see.
Backups
Before a migration or a bulk write, we take an export of every object we will touch and keep it until you sign off. Production systems we build include automated backups configured in your hosting account, with the restore procedure written into the runbook.
Incident response
If we find or suspect a security incident affecting your data or systems, we contain it first, notify you without undue delay, and follow up with a written account of what happened, what was affected and what changed to stop it recurring. Credentials that may be exposed are rotated immediately.
Reporting a vulnerability
To report a security issue with this website or with anything we have built, email hello@hubreven.com. Please do not disclose it publicly until we have had a chance to respond.