Security whitepaper

Approach

RODMENA is a UK software company built around durable, fault-tolerant engineering. We apply the same discipline to our own security: encryption in transit for all services, least-privilege access to systems, hardened self-managed infrastructure, and a development practice designed so that failures are contained and recoverable. We hold minimal personal data — business correspondence only — and we do not use analytics, trackers or advertising cookies on this website.

As a small engineering company, our advantage is a tiny attack surface and direct accountability: the people who operate our systems are the people who built them. Where a control below is engagement-specific, its exact shape is agreed in contract documentation.

Identity & access control

• Multi-factor authenticationKey accounts — code hosting, infrastructure and email — are protected with MFA and strong, unique credentials in a password manager.
• Least privilegeAccess to production systems is limited to the people who need it, via SSH keys rather than passwords; root access is not used day-to-day.
• Customer systems (RBAC)Our software supports role-based access control and multi-tenant isolation (PostgreSQL row-level security in Highway).
• SSOFor customer deployments, integration with your identity provider is scoped per engagement.

Encryption

• In transitTLS for all public services; HTTP traffic is redirected to HTTPS.
• At restApplied per engagement to the environment's capabilities — for customer deployments we recommend and configure encrypted storage and encrypted PostgreSQL backups as standard.

Secure development

• Version controlAll code lives in Git with a reviewable history; secrets are never committed to repositories.
• DependenciesWe deliberately minimise dependencies (Highway needs only PostgreSQL — no Kafka, Redis or external queues) and update them promptly when security advisories are published.
• TestingChanges are verified before release; this website itself is checked by an automated verification suite on every change.

Operations: logging, backups, resilience

• LoggingServer access and error logs are kept for security monitoring and routinely rotated; we log operational metadata, not personal-data payloads.
• BackupsEngagement systems get scheduled, encrypted, tested backups designed to the agreed recovery objectives; Highway's PostgreSQL-native design means standard, proven PostgreSQL backup tooling applies.
• ResilienceDurable-execution design: our flagship platform commits application data and workflow state in the same transaction, so crashes cannot produce partial state.

Vulnerability management

Operating systems and dependencies are patched promptly, prioritised by severity. We publish a responsible-disclosure policy and a machine-readable security.txt.

Penetration testing: Planned — a summary of scope and findings will be published on the Trust Centre after the first engagement.

Incident response & notification

Suspected incidents are triaged immediately by the engineers who operate the affected system. Where an incident affects a customer, we notify them without undue delay with what we know, what we are doing and what we recommend. Personal-data breaches are handled in line with UK GDPR, including notifying the ICO within 72 hours where required. Security contact: enquiries@rodmena.co.uk.

Certification roadmap

Live, honest statuses for Cyber Essentials, ICO registration and ISO/IEC 27001 are maintained on the Trust Centre.