Will you sign a data processing agreement?

Yes. We sign DPAs, mutual NDAs and, where our work involves protected health information, business associate agreements. We also provide subprocessor lists and data flow documentation for your privacy records.

How do you handle access to our production systems?

With named individual accounts, multi-factor authentication, least-privilege scopes and short-lived credentials. Access is granted per engagement, logged, reviewed quarterly and revoked automatically when the engagement ends. Where you prefer we have no production access at all, we work through your team instead.

Do you do penetration testing?

We do application security review, threat modelling and remediation. Formal penetration testing should be done by an independent assessor — we will help you prepare, coordinate with them, and fix what they find.

What happens if there is a security incident?

Severity definitions, response expectations, named contacts and notification commitments are agreed at engagement start rather than improvised during an incident. Afterwards we run a blameless review and track the resulting actions to completion.

Can you complete our security questionnaire?

Yes, and we answer honestly — including marking items as not applicable or not yet in place where that is the truth. A questionnaire answered optimistically creates a problem later for both of us.

Security & quality

Practices we apply on every engagement

Security and quality work is part of normal delivery rather than a gate at the end. Below is what that means concretely — and what we will not claim.

Start Your Project How we work

What we do not claim

Xalicon holds no security certifications today, and we will not display badges we have not earned. Systems we build can be designed to support GDPR, HIPAA, PCI DSS scope reduction and SOC 2 control areas, and we produce the control documentation and evidence your auditors need. Certification itself is issued by an independent assessor, and compliance remains an outcome your organisation owns.

Practices

Eight areas, applied consistently

These are the same practices described in our engagement agreements — not an aspirational list.

Secure development lifecycle

Security is part of normal delivery rather than a gate at the end.

Threat modelling during architecture for authentication, authorisation, payment and data flows
Security acceptance criteria written into stories that touch sensitive paths
Static analysis and dependency scanning on every pull request
Manual review of authentication, session handling and access control logic
Pre-release security checklist based on OWASP ASVS

Access control

Least privilege applied to client systems and to our own.

Named individual accounts with multi-factor authentication — no shared credentials
Access granted per engagement and revoked automatically when it ends
Short-lived, identity-based credentials for cloud access rather than long-lived keys
Production access restricted, logged and reviewed
Quarterly access reviews across all client environments

Data handling

We work with the least client data necessary and treat what we do handle carefully.

Anonymised or synthetic data used for development wherever it is workable
Production data access limited to named individuals with a documented reason
Client data kept in client-controlled systems, not copied to local machines
Encryption in transit and at rest as standard, with documented key management
Defined retention and secure deletion at the end of every engagement

Code review

Every change is reviewed before it reaches a shared branch.

Mandatory peer review with branch protection enforced in the repository
Review checklist covering security, accessibility, performance and testing
Secrets scanning across commits and history, with rotation if anything is found
Architecture decision records for structural changes
Pairing on high-risk changes rather than review after the fact

Testing

Automated verification that makes releases routine.

Unit, integration and end-to-end coverage proportional to risk
Tenant isolation and permission boundaries tested explicitly, including negative cases
Accessibility checks with axe-core running in the pipeline
Performance budgets enforced automatically on every build
Flaky tests treated as defects and fixed rather than retried

Infrastructure security

Infrastructure defined in code, reviewed like application code.

All infrastructure expressed as code and peer reviewed before apply
Network segmentation with private connectivity for data stores
Policy-as-code checks blocking non-compliant infrastructure at pull request time
Container and image vulnerability scanning in the build pipeline
Encrypted backups with periodic restore rehearsals

Incident response

A defined process, agreed with you before it is needed.

Severity definitions and response expectations agreed at engagement start
Named contacts and escalation path on both sides
Structured logging and tracing to shorten diagnosis
Blameless post-incident review with actions tracked to completion
Client notification commitments documented in the agreement

Compliance readiness

We build and evidence controls. Certification is issued by independent assessors.

Systems designed to support GDPR, HIPAA, PCI DSS scope reduction and SOC 2 control areas as applicable
Control documentation and evidence produced as part of delivery
Data flow and subprocessor mapping for your privacy documentation
Support during audits, questionnaires and penetration tests
We never claim a certification we do not hold, or state that a system makes you compliant

Questions

Security questions we are asked in procurement

No, and we will not imply otherwise. Xalicon is newly launched and certification requires an audit period we have not yet completed. What we can show you is the practices below, evidence of how they are applied, and a willingness to work within your control requirements. If a certification is a hard requirement for your procurement process, tell us early so nobody wastes time.

Start a conversation

Send us your security questionnaire

We will complete it honestly, including the items where the answer is 'not yet'. That is more useful to both of us than an optimistic form.

Prefer email? contact@xalicon.co