code/+/trust primary logo full color svg

Trust & Safety

Security & Compliance

Enterprise clients trust us with sensitive business logic and data. Here's exactly how we protect it.

How does Code and Trust protect client data?

Code and Trust implements defense-in-depth security across all client projects and our own infrastructure. Data is encrypted at rest and in transit, access is role-gated by team function, and security reviews are scoped per engagement.

Infrastructure Security

  • –

    All traffic served over HTTPS via Vercel's edge network, with no plain-HTTP endpoints.

  • –

    Data is encrypted at rest and in transit; the specific controls are set per engagement.

  • –

    Environment variables and secrets stored in Vercel Secrets, never committed to source code.

  • –

    Production and development environments are fully separated with distinct credentials.

Application Security

  • –

    Parameterized queries (tagged SQL templates) throughout, with no string concatenation in SQL.

  • –

    OWASP Top 10 practices followed: input validation, output encoding, secure session management.

  • –

    Dependency scanning via GitHub Dependabot.

  • –

    Content Security Policy headers on all responses to mitigate XSS.

Data Handling

  • –

    Client data is isolated per project, with no shared databases between separate client engagements.

  • –

    Minimal data retention: we keep only what's needed for the project, deleted on request.

  • –

    NDA by default for enterprise clients.

Compliance Practices (SOC 2 Alignment)

  • –

    Access controls: role-based access and the least-privilege principle.

  • –

    Change management: all production deployments reviewed and logged.

  • –

    Availability: any availability commitment for a client system is set in that engagement's written agreement.

  • –

    Note: Code and Trust follows SOC 2-aligned practices but has not completed a formal audit. Contact us if your compliance team requires additional documentation.

What is the security incident response time at Code and Trust?

Incident response commitments, including response times, are set in each engagement's written agreement.

Common security questions

Is Code and Trust SOC 2 certified?

Code and Trust follows SOC 2-aligned practices including access controls, encryption, change management, and incident response, but has not completed a formal SOC 2 audit. Enterprise clients requiring formal certification are welcome to conduct their own security due diligence.

How does Code and Trust handle client data isolation?

All client projects receive isolated infrastructure: separate databases, separate environment variables, and separate deployment pipelines. No client data is co-mingled with another client's data. Enterprise clients sign an NDA by default before any discovery conversation.

Report a Vulnerability

If you discover a security vulnerability on codeandtrust.com or in any Code and Trust client-facing system, please report it responsibly. We will acknowledge your report and will not take legal action against good-faith disclosure.

security@codeandtrust.com