Security

Security is part of how Detix Group builds, not a layer added at the end. This page describes the practices behind our work and how this website itself is set up.

This site is deliberately small. It has no accounts, no sign-in, and no product data — which removes most of the surface a company site would otherwise have to defend.

Changes are reviewed before they merge. Dependency advisories are read and updates applied deliberately, rather than in a rush after something breaks. Every change has to pass the type checker and a full production build before it can ship, so a broken change fails before anyone sees it.

Secrets stay out of source control. Access to the systems that hold them is granted per person, not shared.

The safest data is the data we never collect. This site stores no test results, no source code, and no customer records — and it has no form that submits to us: the contact page composes an email in your own mail client instead. What reaches us is the mail you send and the standard technical logs the infrastructure produces, and nothing more. Our privacy policy sets out exactly what that is and how long we keep it.

The site is served over HTTPS, so traffic between your browser and it is encrypted in transit with TLS.

It runs on managed hosting, which puts operating-system patching and physical data-centre security in the hands of people who do that work full time.

Access to our accounts and infrastructure is limited to the people whose work needs it, granted individually rather than through shared logins, and removed when a role changes. We require multi-factor authentication wherever the provider supports it.

The controls that matter when you evaluate software — how it authenticates users, where it stores data, what a deployment looks like — belong to the product, not to a company site. Each product ships with its own terms and privacy policy and answers for the data teams put into it. Delivery Assessment is a service, not a product: that work runs under the engagement agreement described below.

If you are assessing a product and need detail on its controls, ask us. We would rather answer for that specific product than describe security in general terms here.

Detix Services work means looking closely at how a team tests: repositories, pipelines, suites, and the decisions around them. Every engagement runs under a separate written agreement that sets out confidentiality, what we may access, and what happens to material when the work ends.

We take only the access an engagement needs. Findings belong to the client, and we do not reuse a client's material or name them elsewhere without permission.

We hold no security certification, and we will not imply one. When we have something independently audited, this page will say what it is, who issued it, and what it covers.

If a procurement process needs a security questionnaire completed, write to us and we will answer it straight — including where the honest answer is "not yet".

If you believe you have found a vulnerability in this site or in one of our products, tell us before you tell anyone else. Write to hello@detix.group with enough detail to reproduce it. We will acknowledge the report, investigate, and tell you what we find.

On this site, keep testing to requests and data you send yourself — there are no accounts here to stay inside of. In a product, keep to your own account and your own data. Either way, avoid anything that degrades the service for other people, and give us reasonable time to fix an issue before publishing it.