Security architecture
Threat modelling, trust boundaries and control design agreed before development begins.
Home / Service 02
Service 02
Data Security
Security work that starts after a system is live is always more expensive and less effective. We model the threats before the architecture is fixed, then verify the result with testing rather than assurances.
SeptiBytesData securityWhat we do
Protection designed into the build
Every control below is decided before development begins and proven before release. Security is part of the architecture, not a layer added at the end.
Identity and access control
Role based permissions, multi factor authentication, segregation of duties and delegated authority.
Encryption and key management
Protection of data in transit and at rest, with managed keys and certificate lifecycles.
Testing and remediation
Vulnerability assessment, penetration testing, code review and a prioritised fix plan.
Monitoring and response
Centralised logging, alerting, audit trails and a rehearsed incident response process.
Governance and continuity
POPIA and GDPR readiness, retention policy, backup, disaster recovery and recovery testing.
6controls proven before release
Assurance
Evidence, not assurances
Tested before release
Findings fixed before go live, not logged for a later sprint
Segregation of duties
The maker of a transaction cannot be its checker or its payer, enforced in the platform
Full audit trail
Every decision and payment traceable to a user, a rule and a timestamp
Regulatory readiness
POPIA and GDPR, with evidence packs an auditor will accept
Recovery proven
Disaster recovery designed and then actually tested, not assumed
Independent review
Third party penetration testing arranged on request
Related
The other two disciplines
We deliver all three together, because the application, the data it holds and the network it travels on have to be designed against the same requirements.
