→ cat security_posture
secrets: out_of_source_control
access: least_privilege
backups: restore_tested
tls: enforced
pentest_performed: false
soc2_certified: false
✓ no certification claimed anywhere on this site
// security
What we do, what you do, and what needs a third party.
WebNuvexa holds no security certification. We do not perform penetration testing, SOC 2 audits or compliance attestation, and we will not pretend otherwise. What follows is what we actually do, and where your responsibility begins.
Three buckets, no blurring
Security work divides into three categories. Mixing them up is how clients end up believing they are more protected than they are.
What WebNuvexa does
Practices we follow on your systems while we work in them and after handover: secrets handling, least privilege, dependency triage, tested restores, TLS, secure coding, and clean access revocation at the end.
What stays yours
Account ownership, data classification, lawful basis and retention, MFA on your accounts, access to your decision-maker, and commissioning any independent assessment you need.
What needs a third party
Penetration testing, SOC 2 certification, ISO certification, legal and privacy advice. Independent firms only. We can scope, supply evidence and fix findings. We cannot perform or certify any of it.
What WebNuvexa does
Each practice with what it does not cover. The right-hand column matters as much as the left.
| Practice | What we actually do | What this does not cover |
|---|---|---|
| Secrets handling | Secrets never enter source control. They live in environment configuration or a secret manager, injected at deploy time. We hand over an inventory of what exists and where, and rotate anything on our side when the engagement ends. | Secrets already present in your systems before we arrived, or held by third parties we do not administer. |
| Least privilege | Access is granted per person, per environment, and per purpose. Production access is time-bound and read-only unless a change is genuinely required. No shared logins, ever. | The authorisation design inside your product. That is part of the build and is handled in code and code review, not by an account policy. |
| Dependency patching | Dependencies are pinned and monitored against published advisories. Security updates are triaged on a defined cadence, with critical issues handled in days rather than at the next release. Patch status is reported, not hidden. | A guarantee that no dependency is ever vulnerable. Any claim of zero vulnerabilities is not a claim an engineering team can honestly make. |
| Backups and tested restores | Automated backups with documented retention, and restores are actually performed on a schedule and the result recorded. An untested backup is treated as no backup at all. | Your business continuity plan, your disaster recovery objectives, or your obligations to anyone else under your contracts. |
| HTTPS and TLS | TLS on every endpoint, HTTP redirected to HTTPS, HSTS set, cookies marked secure and httpOnly, and certificate renewal automated so an expiry does not become an outage. | Certificate authority compromise, mis-issuance by a CA, or edge and WAF tuning at a scale this studio does not operate. |
| Secure coding | Input validation, parameterised database access, output encoding, CSRF protection, session and authentication handling done deliberately, and security criteria in every code review. | Formal verification, proof of correctness, or an independent security assessment. We write careful code; that is not the same as evidence. |
| Access revocation at project end | Every account, key and seat is removed when the engagement closes, and we tell you in writing exactly what was revoked and when. | Anything we never had access to in the first place. |
What stays your responsibility
The controls on this page fail if these are not in place. They are not a formality and not a way of transferring blame.
| Responsibility | Why it is yours |
|---|---|
| Own the accounts | Domains, hosting, cloud and third-party accounts belong to you. We work inside your accounts rather than holding credentials in ours, so access survives us and leaves cleanly. |
| Decide what data you collect and why | Data classification, retention, consent and lawful basis are business and legal decisions. We implement the mechanics you decide on. Consult qualified counsel, not a studio, for the legal position. |
| Enforce MFA and manage your credentials | Multi-factor authentication on accounts we touch, and rotation of your own credentials. A shared password undermines everything else on this page. |
| Keep the decision-maker available | Most delays are waiting on an answer rather than on the work. Naming one person who can decide in a day is worth more than any tool we could install. |
| Report incidents promptly | Tell us quickly and we will respond quickly. Silence turns a small problem into an expensive one, on either side. |
| Commission your own assessment | If you need penetration testing, SOC 2 or legal assurance, that is your decision and your purchase. We will help you scope it; we do not perform it. |
What needs a qualified third party
WebNuvexa does not perform any of this work, is not accredited to perform it, and cannot certify you. We can scope it, supply evidence, and fix what is found.
| What it is | Who does it | What WebNuvexa does |
|---|---|---|
| Penetration testing or an independent security assessment | A qualified, independent testing firm | We can help you scope the engagement, provide architecture documentation and access, and fix what is found. We do not perform the test, and our own build does not substitute for one. |
| SOC 2 audit and certification | A licensed independent audit firm | We can perform readiness work. We cannot audit, certify, attest or make you compliant. See the readiness section below. |
| ISO certification | An accredited certification body | We have no role in it. We can implement the technical controls an assessor asks for and hand over evidence, but the certificate comes from the body, never from a studio. |
| Legal compliance and privacy advice | Qualified lawyers, and a data protection officer where one is required | We implement engineering controls to the requirements you set. We do not give legal advice, and no engineering decision makes an organisation compliant on its own. |
| Privacy impact assessments | Qualified counsel | We supply the technical detail they need - data flows, retention behaviour, subprocessors - and implement what they conclude. |
On referrals: we will share contact details for independent assessors we have no financial relationship with, as a convenience. We do not receive referral fees, and we are not in a position to vouch for a firm’s competence. Vet them as you would any supplier.
SOC 2 readiness work
A specific offer, stated narrowly, because it is frequently oversold.
Readiness, not certification
Readiness work means gap analysis, drafting the policies and control documentation, implementing the technical controls, and gathering the evidence an assessor will ask for. It prepares you for an audit. It is not an audit.
Typically 8 to 12 weeks
Industry work for SOC 2 readiness commonly runs 8 to 12 weeks before an external assessor is involved (2026 market data). Longer if controls are undocumented, or if infrastructure decisions have to be changed first.
Only an independent firm can certify
The report and the opinion come from a licensed audit firm. We cannot issue one, we are not accredited to issue one, and no amount of engineering work turns into a certificate on its own.
What it does not make you
Readiness does not make you compliant with any law, and it is not a legal opinion. Data protection is an obligation that you meet through controls, records and practice - not a badge you wear.
→ vCISO_band_2026: $3,000 - $15,000 per month
Third-party market figure for virtual security leadership engagements, shown as cost context for organisations that need an ongoing security owner rather than a project. It is not a WebNuvexa price and it is not a quote.
→ webnuvexa_certifications: none
Where this stops
A security page that only lists strengths is marketing. Here is the honest edge of what a small studio can offer.
No 24/7 security operations
This is a small studio. We are not a security operations centre and do not pretend to offer 24/7 monitoring of your estate. That belongs with you or with a managed provider.
No audit, no certificate
We perform no penetration testing, no SOC 2 audit, no ISO certification and no compliance attestation. We are not certified and we do not claim to be.
Compliance is not a feature
No engineering deliverable makes an organisation compliant. That is a legal and organisational outcome, and it needs qualified counsel, records and practice - not a line of code.
Third parties are outside our control
We cannot vouch for the security of the vendors in your stack. We can choose well-worn options and tell you the trade-offs, but their outages and breaches are not ours to prevent.
Ask a security question
Tell us what you need to protect and who needs to be satisfied. We will be precise about what we do, what we refer, and what we would not advise.