Security Policy

Effective date: 21 July 2026

Security is not a department at Code Bunnies Ltd – it is how a two-person studio protects the businesses that trust us with their software. This page describes the practices we actually follow. We do not currently hold formal certifications such as ISO 27001; what follows is how we work, stated plainly.

Infrastructure and hosting

• All traffic to our websites, applications, and APIs is encrypted in transit with TLS.
• Client applications run on AWS, usually the eu-west-1 region in Ireland, and on Hetzner, whose data centres are in Germany and Finland. We will always tell you which one your system runs on, and why.
• Data residency is a decision we make with you, not a default. If your work requires UK-only residency, common in public sector, healthcare, and parts of financial services, we deploy to a UK region instead.
• Residency and sovereignty are not the same thing, and we would rather say so than let "hosted in the EU" carry more weight than it can. Hetzner is a German company with no US parent. AWS holds your data in Ireland but is US-headquartered, and so remains within scope of the US CLOUD Act. If that distinction matters to your risk assessment, it should shape which provider we choose.
• Client applications are deployed to infrastructure in the client's own name wherever possible – you hold the keys to your own production.
• Deployments are containerised and reproducible, with health checks and rollback paths as standard.

Data protection roles

• For our own website and enquiry data, we are the data controller. We are registered with the Information Commissioner's Office under reference ZC198726. That registration is a statutory notification rather than a certification or an audit, and we would not want it read as more than it is.
• For the systems we build and host on your behalf, you are the controller and we are the processor. We work under a written Article 28 data processing agreement, ours or yours.
• Our hosting and infrastructure providers are sub-processors. We keep a current list naming each one and where it processes data, and we will provide it on request or as an annexe to the agreement.
• Personal data transferred outside the UK is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or Standard Contractual Clauses. The EU's adequacy decision for the UK was renewed in December 2025 and runs to December 2031, and the UK recognises the EEA in turn, so data moving between the two needs no additional transfer mechanism.
• You can see how we apply this to ourselves in our Cookie Policy: this site sets one strictly necessary cookie, from Cloudflare, which is why you have never been shown a consent banner.

Access control

• Access follows least privilege: each of us can reach only what our current work requires.
• Multi-factor authentication is enabled on every account that supports it – source control, hosting, registrars, and email.
• Credentials are per-person and per-client. No shared logins, no credentials in code or chat history.
• When an engagement ends, access is revoked and handed over as part of the close-out.

Development practices

• Every feature ships with its test suite; several client codebases enforce full line and branch coverage in CI.
• Static security analysis (such as Brakeman for Rails) runs in CI, and we treat warnings as defects.
• Dependencies and security advisories are monitored continuously; CVE patches are applied promptly, and retainer clients get this proactively.
• Code review applies to our own work as much as to inherited codebases.
• Secrets live in environment configuration and secret stores – never in repositories.

Client data

• We collect the minimum needed to do the work, and production data stays in production wherever practical.
• Files you share with us through the website are stored on encrypted cloud storage with restricted access.
• We are happy to work under NDA – ours or yours – and honour confidentiality after an engagement ends.
• Enquiry data retention is described in our Privacy Policy.

Backups and continuity

• Client systems we operate have automated, encrypted backups with tested restores.
• Our own working repositories are mirrored across independent providers.

Incident response

If we become aware of a security incident affecting a client system or client data, we will contain it, investigate, and notify the affected client without undue delay – with a plain-language account of what happened, what was affected, and what we changed to prevent recurrence.

Reporting a vulnerability

If you believe you have found a security issue in our website or in a system we operate, please email info@codebunnies.com. We will acknowledge your report promptly, keep you informed as we investigate, and never take action against good-faith research.

Changes to this policy

We review this policy as our practices evolve and update the effective date above when it changes.