How We Handle Your Code & Data
Plain answers to what a client reasonably asks before handing over access to a codebase or a server. Last updated October 23, 2026.
What we do not claim
CodeSalen is not ISO 27001 certified, is not SOC 2 audited, and is not a certified partner of any cloud provider. We are a software development company. If your project needs work signed off against a formal framework, you will need an accredited auditor as well as a development team, and we will say so at the scoping stage rather than after you have signed.
1. You own the accounts
Your code lives in your Git repository and your application runs in your hosting or cloud account, both created in your name and paid for by you. We work as invited collaborators. Nothing we build sits in an account only CodeSalen can reach, and nothing depends on us staying in the picture.
2. Access ends when the project does
Developers are given access to what their task needs and nothing wider. When an engineer leaves a project, or when the project closes, their access is removed. At handover you revoke ours too, and we will walk through that step with you so nothing is left behind. Ask us at any point who currently has access and we will tell you.
3. Credentials
Passwords, API keys and certificates are kept out of the repository and out of email and chat. They live in environment configuration on the server, or in whatever secret manager your stack already uses. If you share a credential with us over chat during a handover, rotate it afterwards — that is good practice with any supplier, not just this one.
4. How we write it
We build on frameworks whose own security defaults do real work for you — Laravel, Node and the rest handle SQL parameter binding, CSRF tokens, password hashing and output escaping, and we do not route around them. Dependencies are kept current during the engagement. Sites we deploy are served over HTTPS.
That is ordinary careful development, not a security audit. If you want your application penetration tested before launch, that is a separate piece of work with its own scope and cost, and for a regulated system it is worth commissioning from someone independent of the people who wrote the code.
5. Regulated data
We have built software for healthcare, payments and education clients, and we can build to the technical requirements your regulator or your auditor sets out — audit logging, encryption at rest, role-based access, data retention rules. What we cannot do is certify the result. Compliance is a judgement about your whole organisation, not about one codebase, and it is signed off by an auditor, not by your development team.
6. Confidentiality
We sign an NDA before we see anything of yours, on request and at no cost. Your source code, your data and the existence of your project stay confidential. We do not reuse your code for another client, and nothing appears in our portfolio without your written go-ahead.
7. Where we are
The team is in Rajasthan, India, and all development happens here. If your contract or your regulator requires that data stays in a particular country, that is a hosting decision we will set up in your cloud account in whichever region you specify — tell us before we provision anything.
8. Reporting a problem
If you have found a security issue in something we built, or in this website, write to info@codesalen.com with enough detail to reproduce it. We will confirm we have received it and come back to you with what we intend to do about it. Please give us a reasonable window to fix the issue before publishing it.
Questions this page does not answer? Ask before you commit, not after.
Talk to us