How we handle access to your infrastructure.
Giving an outside company access to production is a serious decision. This page sets out how we work so you can judge it.
Your infrastructure stays yours.
You own your cloud accounts, repositories, applications and data. We operate inside your environment through access you grant and can revoke at any time.
Only what the task needs.
Multi-factor authentication
Required on every account we use.
Least privilege
We request only the roles the task needs, and read-only access wherever possible.
No permanent root credentials
We do not ask for them.
Named accounts
Each engineer uses an individual identity, not a shared login.
Credential and secrets management
Credentials are kept in approved password and secrets managers. We do not keep your secrets in chat, email or personal files.
Logging and auditing
Where your platform allows, our actions run through accounts that are logged, so you can review what was done and when.
Access reviews
Access is reviewed on a regular schedule and removed when an engagement ends or an engineer no longer needs it.
Incident response
If we find or cause a security or reliability incident affecting your environment, we tell you promptly, contain it, and document what happened and what changes.
Confidentiality and data handling
We work under a non-disclosure agreement. We limit the data we touch to what the work requires and do not copy customer data outside your environment unless you ask us to and it is agreed in writing.
Contracts
Engagements run under appropriate agreements: NDA, MSA, SOW and SLA, with data-protection and security terms where needed.
We help teams prepare for SOC 2, ISO 27001 and customer security reviews by putting controls in place and documenting them. We are not an auditor.
Vindove does not currently hold SOC 2 or ISO 27001 certification.
Email us and we will answer them before you commit to anything.
[email protected] →Judge us on how we work.
Talk to us about your environment and what access the work would need.