Security & Compliance

Security is not a feature we add at the end of a project — it is embedded in every architecture decision, every deployment process, and every system we manage. We apply defence-in-depth principles across all our client engagements and internal operations.

We operate on the principle of least privilege: every person, system, and service has the minimum access required to do its job and nothing more. Access is reviewed quarterly and revoked immediately upon offboarding.

All client infrastructure managed by Haywood Technologies adheres to the following baseline controls:

• Network segmentation: Production, staging, and development environments are isolated in separate VPCs or equivalent network boundaries. No direct internet exposure of databases or internal services.
• Firewall rules: Default-deny ingress rules with explicit allowlists. All rules are version-controlled in Terraform or equivalent IaC.
• DDoS protection: Cloudflare or cloud-native WAF and DDoS mitigation on all public-facing endpoints.
• Logging & monitoring: Centralised log aggregation, anomaly detection, and alerting with documented escalation paths.
• Patch management: Critical patches applied within 24 hours of release; standard patches within 7 days.

We enforce encryption everywhere:

• In transit: TLS 1.2 minimum, TLS 1.3 preferred, on all internal and external connections. Certificates are managed via automated renewal (Let's Encrypt or AWS Certificate Manager).
• At rest: AES-256 encryption for all stored data, including database volumes, object storage (S3 or equivalent), and backups.
• Secrets management: API keys, database credentials, and service tokens are stored in a dedicated secrets manager (AWS Secrets Manager, Vault, or equivalent) — never in code, environment files, or version control.
• Backups: Encrypted, geographically distributed backups with tested restoration procedures. Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are defined per client SLA.

We enforce a strict access control policy across all systems:

• Multi-factor authentication (MFA): Required for all engineers accessing client systems, cloud consoles, and code repositories. TOTP or hardware keys preferred over SMS.
• SSH key-only access: Password-based SSH authentication is disabled on all servers we manage. Keys are rotated at least annually or immediately upon team changes.
• Role-based access control (RBAC): Cloud IAM roles, database permissions, and application roles are scoped to the minimum required for each function.
• Privileged access management: Root and administrator accounts are used only for initial provisioning and are then locked. Day-to-day operations use least-privilege roles.
• Access reviews: Quarterly audits of all access grants to client systems, with immediate revocation upon project completion or personnel changes.

All software developed by Haywood Technologies is subject to the following security controls:

• OWASP Top 10: All web applications are reviewed against the OWASP Top 10 before production deployment.
• Dependency scanning: Automated scanning of all third-party dependencies for known CVEs via Dependabot or equivalent, integrated into CI/CD pipelines.
• Static analysis (SAST): Automated static analysis on every pull request to detect security anti-patterns.
• Code review: All code changes require peer review by a senior engineer before merging to the main branch.
• Input validation: All user inputs are validated server-side. SQL queries use parameterised statements. Output is encoded to prevent XSS.
• Security headers: All web applications include X-Frame-Options, Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy headers.

We maintain a documented incident response plan for all managed environments:

• Detection: 24/7 automated monitoring with alerting for anomalous activity, error rate spikes, and security events.
• Initial response: Acknowledged within 1 hour for critical incidents; 4 hours for high severity.
• Client notification: Clients are notified within 2 hours of confirming a security incident that may affect their data, and again within 72 hours with full details (meeting GDPR breach notification requirements).
• Containment & eradication: Affected systems are isolated, root cause identified, and remediation applied before services are restored.
• Post-incident review: A written post-mortem is delivered within 5 business days of resolution, including timeline, root cause, and preventive measures.

We are experienced in implementing and maintaining controls aligned to the following frameworks, tailored to each client's regulatory context:

We evaluate all third-party tools and services before use in client environments. Our assessment covers:

• SOC 2 or ISO 27001 certification status
• Data processing agreements (DPAs) in place
• Geographic data residency requirements
• Historical security incident record
• Supply chain and open-source dependency posture

We maintain a register of all third-party services used in client environments and review it quarterly.

If you discover a security vulnerability in any system or website operated by Haywood Technologies, we ask that you report it to us responsibly:

For security-related enquiries, incident reports, or compliance questions: