We take the security of client data and the software we build seriously. This page summarises our posture and how to reach us about a vulnerability.

01Standards alignment

Engineering practice is built against the OWASP ASVS Level 2 baseline. No certification is held — not ISO 9001, not ISO 27001, not SOC 2 — and no third-party security audit has been performed. An external penetration test is a condition of the first paid production tenant, and it has not happened yet.

Secrets are stored in managed secret stores, never in source control, and rotated on a regular schedule.

02Data handling

Lead and form data flows only through server-side APIs — never through client-side analytics or URLs.

Access to client environments is least-privilege and logged.

03Reporting a vulnerability

Found a security issue? Email mohiuddin@nimikh.com with details and steps to reproduce.

Our machine-readable policy lives at /.well-known/security.txt.

Change history

Log

1 July 2026Initial version published for review.