Security at Setosys
How we protect your data, infrastructure, and client systems — and what we expect from ourselves.
Data residency and hosting
Client project data processed during engagements is stored on isolated infrastructure. We do not share client data between engagements. Data is retained only for the period required to complete the engagement plus any agreed maintenance window.
Least privilege by default
Secure by design
Code review
All production code is reviewed before merge. Security considerations are explicitly checked for authentication, input validation, and data exposure.
Dependency management
Third-party dependencies are reviewed for known vulnerabilities. We avoid unnecessary dependencies and pin versions in production environments.
Environment separation
Development, staging, and production environments are fully isolated with separate credentials, databases, and access controls.
Secret management
No credentials, API keys, or sensitive configuration is stored in source control. Secrets are injected at runtime via environment variables or vault services.
Found a vulnerability?
If you believe you have found a security vulnerability in our systems or in software we have delivered, please report it to us privately before public disclosure. We commit to acknowledging your report within 48 hours and working with you on a remediation timeline.
security@setosys.com →Current standing and roadmap
Questions about our security posture?
Contact us →