Security

We design for security from the first architecture decision, not as a layer bolted on before launch. Least privilege, defence in depth, and secure defaults are how we build by habit — the same standard we hold our own systems to.

We prefer boring, proven technology over novelty for anything that touches credentials, payments, or personal data, and we keep the attack surface small on purpose.

We run on reputable cloud providers with strong physical and network security. Environments are isolated, infrastructure is defined as code and reviewed, and production access is restricted and audited.

• Separate development, staging, and production environments with no shared secrets.
• Network boundaries and firewalls that default to deny.
• Automated dependency and image scanning in the deployment pipeline.

Access to systems is protected by strong authentication. We require multi-factor authentication for administrative access, scope permissions to the least a role needs, and remove access promptly when it is no longer required.

Data is encrypted in transit with modern TLS, and sensitive data is encrypted at rest. Secrets and credentials are stored in dedicated secret managers, never in source control, and are rotated on a regular schedule.

Production data is backed up on a regular schedule with encryption. We test restores so that a backup is a recovery plan, not a hope, and we retain backups for a defined window aligned to each system's recovery objectives.

We monitor systems for availability, errors, and anomalous activity, with alerting that reaches a human when something needs attention. Logs are centralised and access-controlled, giving us the audit trail needed to investigate and respond.

If you believe you have found a security vulnerability in our site or a system we operate, we want to hear from you. Report it privately and give us a reasonable time to investigate and remediate before any public disclosure.

• Email details to hello@ionicwebcreator.com with steps to reproduce.
• Do not access, modify, or delete data beyond what is necessary to demonstrate the issue.
• Act in good faith and avoid privacy violations, service disruption, or data destruction.

We will acknowledge your report, keep you updated, and credit you if you would like once the issue is resolved.

The practices we apply to every engagement, so security is consistent rather than case-by-case:

• Code review and automated checks on every change before it ships.
• Parameterised queries and input validation to prevent injection.
• Sensible security headers, CSRF protection, and safe session handling.
• Regular dependency updates and prompt patching of known vulnerabilities.

We maintain an incident response process: detect, contain, eradicate, recover, and learn. If an incident affects your data or systems, we will notify affected parties without undue delay, share what we know, and follow up with the steps we are taking to prevent recurrence.

For security reports or questions, email hello@ionicwebcreator.com. For a vulnerability, please mark your message as security-sensitive so it is routed and prioritised appropriately.