Legal

Security

Effective
In this policy
Sections
  1. 1. Our approach
  2. 2. This website
  3. 3. Access to your systems
  4. 4. AI tools on your code
  5. 5. Production changes and backups
  6. 6. Incidents
  7. 7. Regulated data
  8. 8. Reporting a security issue
  9. 9. Contact

1. Our approach

We check, build and look after software for a living, so we hold our own systems to the same standard. This page describes how we work. The binding security commitments for a client engagement are in our Client Terms and that engagement's agreement.

2. This website

  • Every page and form runs over HTTPS on Cloudflare.
  • Forms are protected by rate limits, spam traps and checks on where a request comes from.
  • Kit access links are single-purpose, expire after 7 days or 5 opens, and are stored only in scrambled (hashed) form. The kit cookie cannot be read by page scripts.
  • No secret keys ship in the website's code. They live in our hosting provider's encrypted secret storage.
  • We collect as little personal information as we can. Our Privacy Policy lists all of it.

3. Access to your systems

When you hire us, we usually need access to your code, hosting, database or app stores. Here is how we handle it:

  • Your accounts stay yours. Production accounts, domains, app store listings and billing should be in your name, not ours. We work through access you grant and can take away.
  • Least access. We ask only for the access the work needs, and read-only where that is enough.
  • Safe sharing. Never send passwords or keys in plain email, chat or a direct message. We set up a shared password vault or your provider's own invite flow instead.
  • Two-factor sign-in. Our own accounts use two-factor authentication, and we keep credentials in a password manager.
  • Handover. When the work ends, we give back or remove our access, and we tell you which keys and passwords to change. Changing them after handover is your job, because only you can confirm it is done.

4. AI tools on your code

We use AI coding tools to work faster, and an engineer reviews everything before it reaches you. We do not paste production passwords, keys or your users' personal data into AI tools. Where a tool lets us turn off training on what we send it, we turn it off. If your company does not allow AI tools on its code, tell us before work starts and we will put that in the agreement.

5. Production changes and backups

We do not change your live app or database without your go-ahead, except to stop an active incident under an on call plan. Before risky changes we make sure a backup exists or ask you to confirm one does. You remain responsible for your own backups unless your agreement says we run them.

6. Incidents

If we find or suspect a security incident that affects your systems or data, we tell you without undue delay once we know enough to describe it, and we help you contain it within the scope of our engagement. Notices to your users or regulators are your decision and your responsibility, and we will give you the facts you need for them.

7. Regulated data

  • Health data. We do not handle protected health information unless a signed Business Associate Agreement is in place first.
  • Card data. We do not store payment card numbers. Payments go through established payment providers.
  • Other regulated data. If your app holds data covered by a specific law or framework, tell us during scoping so the agreement can cover it.

We do not hold security certifications such as SOC 2 or ISO 27001, and we never claim certifications we do not hold. If your procurement needs a security questionnaire, ask during scoping and we will answer it honestly.

8. Reporting a security issue

If you think you have found a security problem on blinkz.ai or in anything we built, email hello@blinkz.ai with the subject "Security report." Please include what you found, where, and how to reproduce it.

  • We will confirm we received it within 3 business days.
  • If you act in good faith and follow these rules, we will not take legal action against you for your research.
  • Do not access, change or delete data that is not yours, do not disrupt the site, do not run automated scans that degrade it, and do not attempt social engineering or phishing.
  • Give us a reasonable time to fix the problem before you share it publicly.
  • We do not run a paid bug bounty.

For an app we built for a client, we pass the report to that client, because they own the app.

9. Contact

Security questions or reports: email hello@blinkz.ai.