Security at Codlinx.

Security at Codlinx is owned by our Director of Cloud & Platform. We follow a written information security policy reviewed quarterly, with controls aligned to ISO 27001 and SOC 2. Mapping evidence is available on request under NDA.

• In transit: TLS 1.2+ on every endpoint. HSTS preloaded.
• At rest: AES-256 across managed databases, object storage, and backups.
• Secrets: never in source. Managed via cloud KMS, rotated quarterly.
• Backups: point-in-time recovery on production data, restored quarterly as a fire-drill.

• SSO with mandatory MFA across every internal system.
• Least-privilege role-based access. Production access is break-glass, logged, and time-bound.
• Hardware-bound device certificates and full-disk encryption on every laptop.
• Quarterly access reviews. Off-boarding revokes access on the same day.

• Mandatory code review with a second senior engineer before merge to main.
• Static analysis (CodeQL / Semgrep) and dependency scanning (Dependabot / Snyk) on every PR.
• Secrets scanning blocks merges with leaked credentials.
• Container images scanned and signed; only signed images reach production.

We deploy on AWS, GCP, or Vercel — whichever fits the engagement. Network segmentation, private VPCs, WAFs, and managed DDoS protection are the default. All infrastructure is defined as code (Terraform / Pulumi); manual changes are audited.

Centralised log aggregation with 90-day retention by default (extended on request). Alerting for authentication failures, privilege escalation, and anomalous activity. On-call rotations respond to security alerts within 15 minutes.

We maintain a written incident response plan. Severity 1 incidents trigger immediate notification to affected clients and a post-incident review within 5 working days. Tabletop exercises are run twice a year.

Every employee and contractor signs an NDA and completes security training on day one, with annual refreshers. Background checks are run for roles with production access.

We align with ISO 27001 and SOC 2 Type II. We support engagements with HIPAA, PCI-DSS, and GDPR requirements; the specific controls applied are documented in the Statement of Work and DPA.

Found something? Email security@codlinx.com with details and proof-of-concept. We acknowledge within 24 hours and aim to triage within 3 working days. We do not pursue researchers who act in good faith and follow responsible disclosure.