Security & Trust

Last updated: October 16, 2026

This page gathers the questions enterprise buyers and procurement teams ask us most often — where the code lives, how we handle confidentiality and access, how we build securely, and what we can put in writing. If your vendor-review process needs more than what is here, we are glad to complete your security questionnaire and answer follow-ups directly. Reach us at [email protected].

Code Ownership & Storage

We build inside your repositories and cloud accounts from day one — never parked in ours. The source code, the design work, and the intellectual property are yours from the first commit; nothing is held back pending a final invoice and nothing changes hands at the end. The keys and the full version history stay with you throughout, so there is never anything to "claw back" if an engagement ends.

• Source lives in your version control and your cloud, under your access controls.
• You own the code and IP from the first commit — not on final payment.
• We use mainstream, well-supported technology and document as we go, so your own engineers or a different partner can take over cleanly.
• We are glad to run a structured handover whenever you want one.

Confidentiality & NDAs

We sign your non-disclosure agreement before scoping starts, and we work within your access controls and security rules for the duration of the engagement.

• We sign your NDA before confidential details are shared.
• We work within least-privilege access you grant, and only for as long as the work requires it.
• Confidentiality obligations survive the end of the engagement.

Vendor & Security Questionnaires

We are comfortable completing the vendor-risk and security questionnaires larger organizations send over, and we will map our practices to your framework where we can. If you have specific compliance requirements, raise them on the first call and we will give you a straight yes or no rather than a maybe.

To request our responses to a questionnaire — or to send your own — email [email protected] or use our contact form.

Secure Development Practices

Security and testing are part of how we build, not a step bolted on before launch. Across our engagements we apply:

• OWASP-aligned development — we build against widely recognized web security guidance.
• Automated testing — unit and end-to-end tests (for example Vitest and Playwright) and accessibility checks (axe-core) in the pipeline.
• Static analysis — code quality and security scanning (for example SonarQube) as part of CI.
• Modern authentication — standards-based auth (for example OAuth 2.0) and role-based access control.
• Encryption — data encrypted in transit and at rest.
• Audit-friendly logging — meaningful logs and audit trails where the application calls for them.
• A defined security review — testing of normal and failure scenarios before launch.

The exact controls on any given project are set with you up front and sized to the sensitivity of the data and the systems involved.

Data Handling & AI

When we build on your behalf, we act as a data processor: your privacy policy governs the processing and our agreement with you defines our obligations. For features that use AI:

• Systems are configured so your data isn't used to train public models.
• Retention and provider terms are agreed up front, in writing.
• AI-assisted workflows are built with approvals, audit logs, and recovery in mind.

See our Privacy Policy for how we handle personal data, including international transfers, retention, and your rights.

Website Security

This website itself is served over HTTPS with a set of hardening measures in place:

• HTTP Strict Transport Security (HSTS), including subdomains.
• A Content-Security-Policy restricting where scripts, styles, and frames may load from.
• X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN.
• Referrer-Policy: strict-origin-when-cross-origin.
• A Permissions-Policy that denies geolocation, camera, microphone, and payment by default.
• All HTTP requests upgraded to HTTPS.

Compliance Posture

We build to be GDPR-ready and can build to align with frameworks such as HIPAA where an engagement requires it, working within your controls and compliance rules.

We are deliberately plain about what this means: a build does not by itself make an organization compliant or certified. CYBERCUBE Software does not currently hold a formal certification such as SOC 2 or ISO 27001. What we offer is engineering aligned to recognized standards, honest answers on your questionnaire, and a willingness to work inside the controls your own compliance program defines.

Reporting a Vulnerability

If you believe you have found a security vulnerability in this website or in software we operate, please tell us. Email [email protected] with enough detail to reproduce the issue. Our machine-readable contact details are published at /.well-known/security.txt.

Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We will acknowledge legitimate reports and keep you updated on our progress. We do not pursue researchers who report in good faith and avoid privacy violations, data destruction, and service disruption.