Credentials managed outside source control
Credentials live in AWS Secrets Manager and are injected at runtime. Not in application code or shared documents. Rotation procedures are defined for the services in scope.
Security
Security built into the work
Security decisions are often invisible in the finished interface. This page documents the controls in our standard approach and the additional measures considered for higher-risk systems.
Right now
This page, measured on the way to you
Before any of the claims on this page: here is what your own browser can verify right now, taken from the request that delivered this page rather than from a benchmark we ran once on a good day.
N/A
to first byte
Time from request sent to the first byte arriving.
N/A
HTTP version
Which version of HTTP your browser negotiated with the edge. This is a speed
detail, not a security one. The page is served over HTTPS either way.
N/A
edge location
The CloudFront point of presence that served you.
N/A
over the wire
Compressed size against the decompressed document.
N/A
cache
Whether the edge answered without going to the origin.
N/A
encryption
This is the S in HTTPS. TLS 1.2 is the floor here; anything older is refused
outright rather than tolerated.
Worth separating, because the names look alike: HTTPS is HTTP carried inside an encrypted TLS connection. This site is configured to use HTTPS. HTTP/1.1, HTTP/2, and HTTP/3 are versions of the protocol travelling inside it. Newer versions can be faster, but they do not replace TLS. The encryption is the last tile, not the second one.
Measured in your browser from the Navigation Timing entry for this page. Nothing here is sent elsewhere. It is read and displayed locally.
Baseline
Standard engineering controls
These controls form the starting point for our projects. The final architecture and control set are documented in the engagement scope and adjusted to the system's risk.
Least-privilege access
Scoped IAM roles use explicit policies for each component. Permissions are limited to the resources and actions required by the approved design.
TLS 1.2 as the floor
Enforced at the edge and again between the edge and the origin. Older protocol versions are refused, and HSTS directs compatible browsers to use HTTPS.
The origin is not reachable
Static assets are served through CloudFront using origin access control, with public access blocked on the bucket. This restricts direct access to the backing storage.
Infrastructure as code
Terraform with remote state makes infrastructure changes reviewable and reproducible. The goal is to minimize configuration that exists outside the documented deployment process.
Managed authentication
Cognito with external identity providers, rather than hand-rolled session handling. Password storage, token issuance, and rotation are problems that should not be solved from scratch on a client project.
Server-side bot defence
reCAPTCHA Enterprise with validation performed on the server, plus honeypot fields. Scoring that only happens in the browser is bypassed by anyone who skips the browser.
Audit logging with retention
Application and API access logs with defined retention windows, so when someone asks what happened and when, there is an answer rather than a shrug.
Where controls live
Security is part of every layer
Edge, application, data, and access controls reinforce one another. This is the compact view; the services page contains the complete interactive stack.
-
01
Edge
Where requests arrive
-
02
Application
Where the work happens
-
03
Data
Where state lives
-
04
Foundation
What holds it up
Beyond the baseline
What we add when the data justifies it
A marketing site and a system holding sensitive records do not warrant the same posture. These are scoped per engagement, priced into the work, and decided with you rather than assumed.
- Web application firewall: managed rule sets and rate limiting in front of the application.
- Content Security Policy: a strict script and resource allowlist that limits the impact of an injection.
- Customer-managed encryption keys: KMS keys you control and can revoke rather than AWS-managed defaults.
- BAA-eligible service selection: an architecture constrained to services that can operate under a business associate agreement.
- Extended audit trails: longer retention, tamper-evident storage, and access review reporting.
- Network isolation: private subnets and VPC endpoints that keep internal traffic off the public internet.
In practice
We run on this too
This site uses the same core setup described above: Terraform-defined infrastructure, Secrets Manager, TLS controls, origin access control, and scoped IAM. So does Veravox. We are not describing a standard we hold clients to and exempt ourselves from.
It also means that when we tell you a control is straightforward to implement, it is because we have already implemented it, not because it sounded reasonable.
Review your current architecture
We can review your current setup, identify material issues, and recommend priorities. The initial review is offered at no charge, subject to scope and availability.