Skip to main content

Legal

Security Statement

Security Statement

Codepixel builds software for product teams that take security seriously. This statement summarizes the controls we apply to our own operations and client engagements.

This is a public-facing summary. We maintain a more detailed internal Information Security Policy and can share specific sections under NDA with clients and prospects as part of procurement review.

1. Our approach

We apply defense in depth: layered controls so that no single failure compromises a system. Specifically, we lean on:

  • Strong identity and access controls.
  • Modern encryption at rest and in transit.
  • Centralized secret management with strict access.
  • Mandatory code review with automated and AI-assisted security checks.
  • Clear incident response.

We are a small organization. We choose to invest in process discipline and tool quality over headcount-heavy security functions.

2. Identity and access

  • Single Sign-On (SSO) with mandatory Multi-Factor Authentication (MFA) for all production systems and shared business tools.
  • Least-privilege access provisioning: people get the minimum access required for their role.
  • Quarterly access reviews to ensure that access is removed when no longer needed.
  • Hardware-keyed accounts for administrative roles where the platform supports it.

3. Data protection

  • Encryption in transit with TLS 1.2 or higher on all production endpoints (codepixel.me, internal tools, sub-processor APIs).
  • Encryption at rest through our cloud providers' platform defaults (AES-256 or equivalent).
  • Device encryption (BitLocker on Windows, FileVault on macOS) is enforced on all staff endpoints.
  • No unprotected client data on local devices. Sensitive client artifacts are kept in encrypted shared storage with access logging.

4. Secret management

  • Production secrets (API keys, database credentials, signing keys) live in a centralized password manager with role-based access.
  • No hardcoded secrets in source code. Automated secret scanning runs on every pull request.
  • Secrets are rotated on a defined schedule and on personnel changes.

5. Secure development

Every client codebase we touch goes through the following controls:

  • Mandatory pull-request review before any code reaches a protected branch.

  • Automated secret scanning on every PR (catches accidentally committed credentials).

  • Static application security testing (SAST) and software composition analysis (SCA) on every PR (catches common vulnerability classes and vulnerable dependencies).

  • Dependency vulnerability alerts from the platform (e.g., Dependabot) triaged on a regular cadence.

  • No direct merges to protected branches — all changes go through the review pipeline.

  • Two AI-assisted code review gates:

    • Per-PR review (correctness + security).
    • Pre-delivery codebase-level review with a written Findings Register signed off by a human reviewer.

    Details in our AI Use Policy.

6. Hosting and data residency

  • Website hosting: Vercel (US/EU edge), GDPR DPA + SCCs in place. EU edge nodes serve EU traffic.
  • CRM: Pipedrive — EU server region preferred where available.
  • CMS: Strapi, self-hosted on Codepixel-controlled infrastructure.
  • Error monitoring: Sentry, EU (Frankfurt) region.
  • Sub-processor list: see the full vendor table in our Privacy Policy.

For client engagements, we follow each client's data-residency requirements as defined in the SOW and DPA.

7. Website security controls

codepixel.me itself ships with an enforced browser security posture:

  • Content Security Policy (CSP), enforced in production: external script, style, frame, image, and network destinations are allowlisted, and requests to origins outside the allowlist are blocked by the browser.
  • HTTP Strict Transport Security (HSTS) with preload, so browsers refuse to connect over plain HTTP.
  • Hardening headers: X-Content-Type-Options: nosniff, Referrer-Policy, X-Frame-Options, and a restrictive Permissions-Policy (camera, microphone, and geolocation disabled).
  • Privacy-minimized error monitoring: the browser Sentry SDK loads only after you accept analytics cookies, reporting is active only on the production domain, and server-side error events exclude IP addresses, cookies, and form contents.
  • Automated regression tests assert that these headers stay present.

8. Incident response

We follow an internal incident-response runbook with the following client-visible commitments:

  • Notification SLA: confirmed incidents that affect client data are communicated to the affected client within 24 hours of confirmation.
  • Post-incident review: every confirmed incident gets a written post- mortem shared with the affected client within 30 days.
  • Honest disclosure: we do not hide AI-related or process-related root causes from post-mortems.

9. Vendor and sub-processor management

  • Every sub-processor goes through a vendor risk review before we onboard them.
  • We require a written DPA (Data Processing Agreement) and, where data leaves the EU/EEA, EU Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914.
  • Sub-processor list is maintained in our Privacy Policy and updated when it changes.
  • A Codepixel-issued DPA is available to clients on request.

10. Workplace conduct

Security is also about people. We maintain a workplace Code of Conduct covering anti-harassment, anti- discrimination, and reporting channels for misconduct. The internal operational version is available on request to procurement teams.

11. Compliance alignment

We follow best practices aligned with:

  • EU GDPR and Montenegrin Law on Personal Data Protection.
  • Canada PIPEDA and British Columbia PIPA.
  • Industry baseline frameworks including OWASP ASVS and CIS Controls.

We hold ISO 27001 (Information Security Management) and ISO 9001 (Quality Management) certifications. Audit summaries and certificate references are available to clients and procurement teams on request via privacy@codepixel.me. We do not currently hold SOC 2; it is not part of our short-term certification roadmap.

12. Responsible disclosure

If you believe you have found a security vulnerability on codepixel.me or in a Codepixel-operated system:

  • Email privacy@codepixel.me (subject: "Security report").
  • Provide enough detail for us to reproduce the issue.
  • Please do not publicly disclose, exfiltrate, or destroy data while testing.
  • We aim to acknowledge within 2 business days and provide a fix or remediation plan within 90 days of confirmation. We won't pursue legal action against good-faith researchers who follow these guidelines.

We do not currently run a paid bug bounty program. Public acknowledgement (with your permission) is available for valid reports.

13. Contact

For security or procurement questions:

  • Email: privacy@codepixel.me (subject: "Security" or "Procurement")
  • For a current security review pack (DPA, sub-processor list, questionnaire responses), email the same address with subject "Security pack request".

Last reviewed

2026-08-19 — v1.1. Reviewed by Codepixel leadership. Next scheduled review: 2027-05-22 (annual).

Change log

  • v1.1 — August 2026. Documented the website's enforced security controls: Content Security Policy, HSTS with preload, hardening headers, privacy-minimized and consent-gated error monitoring, and the automated header regression tests.
  • v1.0 — Initial publication (May 2026).