Security, data and terms
What you would want to check before trusting us with your systems: where the software runs, how it is kept secure and backed up, who else handles your data, what you own and how you leave.
Where your software runs
We agree where your system will be hosted in the written scope, before anything is built. Websites and small apps run on our own platform, a DigitalOcean server in New York. A system that holds UK personal data can run in DigitalOcean's London region, which is where our own self-storage platform, StoreBay, keeps its data.
You don't need a server, an IT team or a hosting contract of your own: hosting and looking after the software is part of the monthly fee.
How we keep it secure
- Every site and app is served over HTTPS only, with certificates renewed automatically, and with strict security headers, including a content security policy that stops a page loading scripts from anywhere we haven't allowed.
- Servers accept connections only for the web and for SSH, and SSH accepts keys only, never passwords. Repeated failed attempts are blocked.
- Security updates are installed automatically every day.
- Health checks run every five minutes and alert us when a site, an app, a backup or the disk needs attention.
- Secrets such as API keys are kept out of the code and readable only by the service that needs them.
Backups
Our platform's servers are backed up daily by DigitalOcean, and those backups are kept for up to four weeks. Applications that store data also make their own nightly backup copies, and the health checks tell us if the newest one is missing or too old.
Your data, and who else handles it
The scope lists every outside service your system will use, what data it will send to each one, and where that service processes it, so you can check it against your own obligations before we build anything. The services behind our own platform are:
- DigitalOcean: servers and backups.
- Resend: sending email, such as form submissions and alerts.
- Cloudflare: DNS and email routing for our own domain.
- Fathom Analytics: visit counts on this website only, without cookies.
When we build AI into a system, the scope names the AI provider, what it is sent and what a person checks. We don't use your data to train models, and we don't use it for anything but your system.
For how this website handles the details you send us, see the privacy notice.
The terms, in plain words
- Every project starts with a written scope. Each stage up to go-live has a fixed price, agreed before it starts, and you can stop after any stage and keep what has been built.
- Once it's live, a monthly fee covers hosting, updates, fixes when something breaks and small changes. Anything bigger is quoted first.
- You own the code and the data from the start. Your code is kept in a repository you own.
- If you move on, to your own developers or another company, we hand over the code, the data and the documentation, and help move the hosting. There is no lock-in.
More on each of these in how we work. If you need something in writing for your own checks, such as a security questionnaire, ask us in your enquiry.
The company
Sellframe Ltd, registered in Scotland, company number SC472357, incorporated 13 March 2014. Registered with the Information Commissioner's Office, ZA781833.
Tell us what you want to build
A few lines is enough to start. We reply within one working day.
Start a project