Last updated 1 July 2026 · Draft, pending legal review
We take the security of client data and the software we build seriously. This page summarises our posture and how to reach us about a vulnerability.
Our engineering practices are aligned with ISO 9001 and ISO 27001 principles and with GDPR and PDPA 2026 data-handling requirements.
Secrets are stored in managed secret stores, never in source control, and rotated on a regular schedule.
Lead and form data flows only through server-side APIs — never through client-side analytics or URLs.
Access to client environments is least-privilege and logged.
Found a security issue? Email hello@nimikh.com with details and steps to reproduce.
Our machine-readable policy lives at /.well-known/security.txt.