Standards & Claims
The standards we apply to our own work, and a plain statement of the things SOCIA does not claim.
- OWASP
- AppSec Baseline
- WCAG 2.1 AA
- Accessibility Target
- Least privilege
- Access Default
- Client-owned
- Source and Data
Engineering Standards
Code review on every change, protected branches, automated test gates, conventional commit history, and static analysis in the pipeline. These are applied as a default, not offered as an upgrade.
- Review on every change
- Automated test gates
- Static analysis in CI
- Documented architecture decisions
Application Security
We build to the OWASP baseline: input validation, parameterised queries, output encoding, secure session handling and dependency scanning. Authentication and payment code gets additional manual review.
- OWASP-aligned practices
- Dependency and licence scanning
- Secret detection in commits
- Extra review on sensitive modules
Data Handling
Client data stays in the client's systems and cloud accounts. We work with least-privilege access, remove access when an engagement ends, and sign data-processing terms where personal data is involved.
- Data stays in your environment
- Least-privilege access
- Access revoked at project end
- Data-processing terms on request
Accessibility
Interfaces are built to WCAG 2.1 AA as a design target — semantic markup, keyboard operation, visible focus and adequate contrast. Public-sector work treats this as a hard requirement.
- WCAG 2.1 AA target
- Keyboard and screen-reader checks
- Contrast and focus-state review
- Documented in handover
Contracts and Intellectual Property
Source code, infrastructure definitions and design files are yours. No proprietary runtime is required to keep your product running, and no licence is withheld to create a dependency.
- Full source-code ownership
- Infrastructure as code included
- No licence lock-in
- Open-source licences documented
What We Do Not Claim
SOCIA does not hold ISO 27001, SOC 2, HIPAA or PCI-DSS certification, has not won industry awards we can point you to, publishes no customer counts or revenue figures, and holds no cloud partner-tier designations. If a supplier page claims all of these, treat it as a signal — we would rather tell you what is true.
- No ISO 27001 or SOC 2 certification claimed
- No HIPAA or PCI-DSS certification claimed
- No awards claimed
- No client counts or revenue figures
Need a Security Questionnaire Answered?
Send it over. We will answer it accurately, including the questions where the honest answer is that we do not hold the certification.