Security you can prove. Before you sign.
Systems that hold personal data must be secure, and you must be able to show it. We build to OWASP ASVS and UK GDPR from day one, test every change, have independent testers try to break in before launch, and give your procurement team the evidence it asks for.
Where your data goes, and who can reach it.
This is the usual path through a system we build. Your project gets its own version of this diagram, with every supplier named, to drop straight into your DPIA.
- Your usersBrowser or app
- Edge networkEdge
- Application · UK regionApp
- Database · UK regionDatabase
Named subprocessors
- Vercel hosting, London functions
- Resend email
- Neon database, London
Per project Twilio (SMS), Stripe (payments), an AI provider: only if your project needs them, and named in your DPA.
- In transitTraffic from the browser is encrypted with TLS 1.3, the current standard for HTTPS. The application reaches the database over an encrypted connection too.
- At restThe database and its backups are encrypted with AES-256 on disk, so a stolen drive is unreadable.
- In the UKThe application and the database run in London. Anything that runs elsewhere is named, with its safeguards, before you sign.
How we build it safely
These apply to every system we build. Each one is something your IT team can check.
OWASP ASVS as our checklist
OWASP is the open community behind the best-known web security standards. Its Application Security Verification Standard (ASVS) lists the controls a secure application needs, from password storage to session handling. We build to it, and test against the OWASP Top 10, the most common ways web applications are attacked.
UK GDPR by design, and DPIA support
We collect only the data you need, record consent where consent is the lawful basis, and build in tools for subject access and deletion requests. We supply the data flows and technical detail your data protection impact assessment (DPIA) needs.
Least-privilege access
Each person gets only the access their job needs. Staff sign in with your organisation’s single sign-on over SAML 2.0 or OpenID Connect (OIDC), so a leaver loses access when IT switches off one account. Two-step sign-in (MFA) and role-based access control (RBAC) are checked on the server for every request.
Audit trails of changes
Changes to records are logged with who made them, what changed and when. The log cannot be edited from the application, and it can be exported for an investigation or an audit.
Automated tests and review-gated migrations
Tests run on every change, and nothing goes live unless they pass. Changes to the database structure, called migrations, are previewed and reviewed before they touch live data.
Separate live and staging
New work is tried on a staging copy first. Live data stays in the live environment, with its own keys and its own list of who can reach it.
Monitoring with alerts
Errors and failing scheduled jobs raise an alert as they happen, so we usually know about a problem before your users do.
Backups with restore checks
Daily backups plus point-in-time restore, so the database can be wound back to a moment before a mistake. We test restores, because a backup nobody has restored is only a hope.
An incident plan, written down
Who does what, who is told and how fast if something goes wrong. It is agreed with you before launch and fits your own duties, including the 72-hour window for telling the ICO about a reportable personal data breach.
Who processes your data
Our usual suppliers. Each project’s data processing agreement (DPA) names the exact ones it uses, where they process data and the safeguards in place. Prefer your own cloud account? We can deploy into it instead.
| Supplier | What it does | Where |
|---|---|---|
| Vercel | Hosting: runs the application and serves its pages | Application functions in London |
| Neon | The database that holds your data | London |
| Resend | Sends email notifications and messages | Location and safeguards set out in your DPA |
| Per project | Twilio for SMS, Stripe for payments, an AI provider: only if your project needs them | Named in your DPA, with location and safeguards |
Health data, every day. Independently penetration tested.
The platform we built for NHS Stop Smoking Services handles health data every day for nine services in England. It has been independently penetration tested, and we still run and look after it.
Read the NHS platform case study- Single sign-on, access by roleStaff sign in with their organisation’s accounts and see only what their role allows.
- Scoped per serviceEach local service sees only its own clients, clinics and stock, from one shared system.
- Changes on the recordWho changed what, and when, is kept for records, notes and consents.
- Monitored, with alertsSystem health and errors are monitored, and the team is alerted when something needs a person.
- 500+ staffsign in to it to do their daily work.
- Over 150,000 client recordsheld for stop smoking across the nine services.
The procurement pack. Ready before you sign.
Ask for any of these before you commit. Mention it when you book the consultation and we will send what applies ahead of the call.
Penetration test summary
For systems that hold personal data, an independent specialist firm tries to break in before launch. You get a summary of what they found and how each issue was fixed and retested.
Data processing agreement
Our standard DPA, or yours, setting out what we process on your behalf, with every subprocessor named.
DPIA support
The data flows, the risks we see and the technical controls your data protection impact assessment needs, written for your data protection officer.
Data-flow diagram
The diagram above, drawn for your project: every system, every supplier and every region your data passes through.
Policies
Hosting, backup, access and incident response policies in writing, plus a data retention template you fill in with your own periods.
Security questionnaire answers
We complete your supplier security questionnaire with you, question by question, with evidence where it asks for it.
Security questions
Something else? hello@echticstudios.com
Can you work with NHS or public-sector data?
Yes. We already run a platform that handles health data every day for nine NHS Stop Smoking Services in England, with single sign-on, per-service scoping and a full history of changes.
Can you help with our DPIA?
Yes. We provide the data flows, the risks we see and the technical controls in place, and we review your draft with your data protection officer.
Can our data stay in the UK?
Your application and database are hosted in London. Where a supplier processes data elsewhere, such as for SMS or AI, we name it in the DPA with its safeguards, and can usually choose a UK or EU option.
Can our staff use our own single sign-on?
Yes. We connect to Microsoft 365, Google Workspace, Okta and others over SAML 2.0 or OIDC, and roles can follow the groups your IT team already manages.
Can you review a system someone else built?
Yes. We start with a security review against OWASP ASVS and give you a plain-English list of fixes, most important first.
What happens if something goes wrong?
We follow the incident plan agreed with you: contain it, tell you without delay and give you the facts you need to decide on reporting to the ICO. Then we fix the cause and write it up.
Tell us what your auditors will ask for.
A free consultation, with the security pack sent ahead of the call if you want it. Then a fixed quote in stages.