Security
Security whitepaper
How we secure our systems, our development practice and our customers’ deployments: proportionate, concrete and honest.
Approach
RODMENA is a UK software company built around durable, fault-tolerant engineering. We apply the same discipline to our own security: encryption in transit for all services, least-privilege access to systems, hardened self-managed infrastructure, and a development practice designed so that failures are contained and recoverable. We hold minimal personal data, business correspondence only, and this website uses no analytics, trackers or advertising cookies.
As a small engineering company, our advantage is a tiny attack surface and direct accountability: the people who operate our systems are the people who built them. Where a control below is engagement-specific, its exact shape is agreed in contract documentation.
Identity and access control
- Multi-factor authentication
- Key accounts, code hosting, infrastructure and email, are protected with MFA and strong, unique credentials in a password manager.
- Least privilege
- Access to production systems is limited to the people who need it, via SSH keys rather than passwords; root access is not used day to day.
- Customer systems (RBAC)
- Our software supports role-based access control and multi-tenant isolation, with PostgreSQL row-level security in the products that hold tenant data.
- SSO
- For customer deployments, integration with your identity provider is scoped per engagement.
Encryption
- In transit
- TLS for all public services; HTTP traffic is redirected to HTTPS.
- At rest
- Applied per engagement to the environment’s capabilities; for customer deployments we recommend and configure encrypted storage and encrypted PostgreSQL backups as standard.
Secure development
- Version control
- All code lives in Git with a reviewable history; secrets are never committed to repositories.
- Dependencies
- We deliberately minimise dependencies (Highway needs only PostgreSQL: no Kafka, Redis or external queues) and update them promptly when security advisories are published.
- Testing
- Changes are verified before release; this website itself is checked by an automated verification suite on every change.
Operations: logging, backups, resilience
- Logging
- Server access and error logs are kept for security monitoring and routinely rotated; we log operational metadata, not personal-data payloads.
- Backups
- Engagement systems get scheduled, encrypted, tested backups designed to the agreed recovery objectives; Highway’s PostgreSQL-native design means standard, proven PostgreSQL backup tooling applies.
- Resilience
- Durable-execution design: Highway commits application data and workflow state in the same transaction, so crashes cannot produce partial state.
Vulnerability management
Operating systems and dependencies are patched promptly, prioritised by severity. We publish a responsible-disclosure policy and a machine-readable security.txt.
Penetration testing: Planned A summary of scope and findings will be published on the Trust Centre after the first engagement.
Incident response and notification
Suspected incidents are triaged immediately by the engineers who operate the affected system. Where an incident affects a customer, we notify them without undue delay with what we know, what we are doing and what we recommend. Personal-data breaches are handled in line with UK GDPR, including notifying the ICO within 72 hours where required. Security contact: security@rodmena.co.uk.
Certification roadmap
Live, honest statuses for Cyber Essentials, ICO registration and ISO/IEC 27001 are maintained on the Trust Centre.