Security

Last updated: September 3, 2026

Devlura's security practices span our infrastructure, our team, and how we build software — the same standard applies whether it's a client's data at rest or a line of code on its way to production.

Infrastructure — we build on established, independently-audited cloud providers rather than running our own servers, configured to the same guidance any regulated deployment would follow.
People — every engineer with production access is a named member of our small core team, not a rotating outsourced bench, and access is granted narrowly and revoked the moment it is no longer needed.
Development — every change to Devlura's own systems goes through review and automated checks before it reaches production — the same discipline we bring to client work.

Data & Infrastructure Security

We rely on established, independently-operated cloud providers to store and process data, rather than running our own servers — the physical security, redundancy and patching of the underlying infrastructure is handled by providers whose core business is doing exactly that, to a higher standard than a small team could replicate alone.

Data encryption — Data is encrypted at rest by our infrastructure providers, and every connection to our Site and admin tools is encrypted in transit over HTTPS.
Access control — Session cookies are set httpOnly and are only ever transmitted over an encrypted connection in production, and every admin action is authorised on the server rather than hidden behind a client-side screen — so it cannot be bypassed by disabling JavaScript or forging a request directly.
Credential handling — Account passwords are hashed before storage; Devlura never has access to, and cannot recover, a plaintext password.
Secrets management — API keys and database credentials live in environment variables scoped to our deployment, never committed to source control.

Personnel Security

Devlura is a small, remote, engineer-led team — the same people who scope an engagement are the ones with access to build and ship it. That has a real security benefit: there is no large, rotating support bench holding standing access to client systems.

Least-privilege access — Access to client systems, source code and infrastructure is granted only to the people actively working on that engagement, and removed once it ends.
Direct accountability — Every engineer with production access is a named, known member of our core team, not an outsourced or subcontracted role.
Confidentiality — Client engagements are governed by the confidentiality terms in the signed services agreement for that work, independent of anything on this website.

Not yet formalised — a documented security-awareness training cadence, background-check policy, and onboarding/offboarding checklist are not published here. If a client engagement needs evidence of these for a vendor security review, ask us directly and we will provide what is actually in place, rather than assert more than is true.

Application Development

Our engineers build client work and Devlura's own systems the same way — security treated as part of the work, not a separate pass at the end.

Code review — Every change goes through GitHub and is reviewed before it merges; nothing reaches production unreviewed.
Automated checks — Type-checking and linting run before a change ships, catching a class of bugs — several of them security-relevant — before they reach a live environment.
Input validation — Every API endpoint that accepts user input validates it strictly on the server, request by request, before it touches a database or a file — never trusting the client alone.
File uploads — Uploaded files, such as CVs and contact-form attachments, are type- and size-checked, then stored with a managed file provider rather than saved directly to our own servers.

Not yet in place — we do not currently run a formal penetration-testing programme or a web application firewall. Our priority at our current scale has been the fundamentals above; if an engagement specifically requires either, we can scope and add it for that engagement.

Taking projects for next quarter

Let us build somethingworth maintaining

Tell us what you are building and what is in the way. You will speak to an engineer, not an account manager, and leave the call with a straight answer.

Send a brief

Typically replies within one business day · NDA on request

Data & Infrastructure Security

Data encryption — Data is encrypted at rest by our infrastructure providers, and every connection to our Site and admin tools is encrypted in transit over HTTPS.
Access control — Session cookies are set httpOnly and are only ever transmitted over an encrypted connection in production, and every admin action is authorised on the server rather than hidden behind a client-side screen — so it cannot be bypassed by disabling JavaScript or forging a request directly.
Credential handling — Account passwords are hashed before storage; Devlura never has access to, and cannot recover, a plaintext password.
Secrets management — API keys and database credentials live in environment variables scoped to our deployment, never committed to source control.

Personnel Security

Least-privilege access — Access to client systems, source code and infrastructure is granted only to the people actively working on that engagement, and removed once it ends.
Direct accountability — Every engineer with production access is a named, known member of our core team, not an outsourced or subcontracted role.
Confidentiality — Client engagements are governed by the confidentiality terms in the signed services agreement for that work, independent of anything on this website.

Application Development

Our engineers build client work and Devlura's own systems the same way — security treated as part of the work, not a separate pass at the end.

Code review — Every change goes through GitHub and is reviewed before it merges; nothing reaches production unreviewed.
Automated checks — Type-checking and linting run before a change ships, catching a class of bugs — several of them security-relevant — before they reach a live environment.
Input validation — Every API endpoint that accepts user input validates it strictly on the server, request by request, before it touches a database or a file — never trusting the client alone.
File uploads — Uploaded files, such as CVs and contact-form attachments, are type- and size-checked, then stored with a managed file provider rather than saved directly to our own servers.