You own everything
Your apps, accounts, hosting and data stay in your name, on your billing. We work inside them as a named user you can remove with one click. If we part ways, you keep everything and nothing breaks.
Security & trust
How we protect your business
We're a security-first shop, so we hold ourselves to the same standard we build for you. Here's exactly how we handle your systems and data, in plain English.
Our access is limited and visible
We use our own named account for each client, never your login, with multi-factor authentication turned on. We ask only for the access a job needs, and your system logs show what we did.
Every change is reviewed
Code changes go through version control with a review before release. Nothing goes live in your business without your approval, and every change has a record.
AI tools never hold your passwords
We use AI assistants to work faster. They never receive your credentials directly, they act only through access we control and can revoke, and anything that touches your live systems needs a human's approval.
We never handle card data
Payments always run through established processors like Stripe or Square, so your customers' card numbers never pass through us or the tools we build.
Our own house is in order
Encrypted devices, a password manager, MFA everywhere, written security policies and a vendor list. Our practices follow the CIS Controls and are aligned with SOC 2, drawing on five years of running a SOC 2 program.
What we can and can't promise
No one can honestly guarantee a system is 100% secure, and we won't pretend to. What we promise is careful work, clear records, and that we'll tell you about problems as soon as we find them.
We are not SOC 2 certified or audited today. If your customers or contracts require a SOC 2 report from your vendors, ask us and we'll tell you where we stand.
Health information
If your business handles patient health information, tell us on the first call. We'll explain what we can safely take on, how we keep that data out of our tools, and when a Business Associate Agreement is needed. We never claim to be "HIPAA certified," because no such certification exists.
Report a security issue
Found a vulnerability in something we built or run? Email security@camdunsolutions.com. We'll acknowledge it within two business days. You can also find our security contact details in the standard format security researchers use.
Next step
Questions about security? Ask us anything.
A free 30-minute call. No pitch, no pressure. If we are not the right fit, we will tell you who is.