Security and compliance

Security is part of our definition of done, not a separate stage at the end of a project. This page describes the practices we apply internally and can document contractually for clients.

1. Secure development

• Mandatory static analysis (PHPStan at maximum level) and style checks on every pull request.
• Mandatory review by a second engineer; nobody approves their own changes.
• Automated dependency scanning for known vulnerabilities, on every build and daily on the main branch.
• Automated tests for critical flows, with a minimum coverage threshold agreed per project.
• Secrets handled exclusively through environment variables or encrypted vaults, never in the repository.

2. Infrastructure

• TLS 1.3 encrypted traffic, with HSTS enabled and forced redirection to HTTPS.
• Complete separation between development, staging and production environments, with distinct accounts.
• Infrastructure described as code, so any environment can be recreated identically.
• Daily encrypted backups, with quarterly restore testing.
• 24/7 monitoring and alerting for availability, latency and application errors.

3. Access control

• Two-factor authentication is mandatory for all internal accounts.
• Least privilege: production access is granted by name and for a limited period.
• Logging of administrative operations and quarterly review of permissions.
• Automatic revocation of access on the day a team member leaves the engagement.

4. Compliance and data protection

We align our processes with the GDPR requirements and the ISO/IEC 27001 controls. For clients in the financial or healthcare sectors we implement additional requirements (PSD2, DORA, internal audit requirements) defined during discovery. We sign data processing agreements and non-disclosure agreements before accessing any client system.

5. Incident management

We maintain a documented incident response procedure, with assigned roles, a dedicated communication channel and a 4h response time for critical severity. Affected clients are notified within 24 hours of a confirmed security incident, and the post-incident analysis is delivered in writing within five working days.

6. Reporting a vulnerability

If you have identified a security issue in our systems or in systems we operate, write to contact@nextlevelsoft.ro with the subject "Security". We acknowledge receipt within 24 hours and keep you informed until the issue is resolved. We ask that you do not access data that is not yours and that you allow us a reasonable remediation window before any public disclosure.