Security you can document.
Wallue is built around a simple principle: customers should retain control of access, systems and delivery environments wherever practical.
Customer-controlled
Least privilege
Individual accounts
Documented
You control access.
Where practical, developer accounts and permissions should be created inside customer-controlled systems. Customers decide which environments, repositories and tools each engineer can access, and can revoke access when required.
Approved partner-network wording: Wallue only works with partner-network suppliers certified to ISO 27001 and/or ISO 9001.
Data handling follows the project requirements.
We prefer engineering work to happen inside customer-controlled systems and environments. If Wallue or a delivery partner needs to process personal data on behalf of the customer, the required data-processing terms and safeguards are agreed before access is provided.
- —Repositories
- —Identity
- —Data
- —Offboarding
- Use customer-owned repositories where practical.
- Individual accounts with role-appropriate permissions.
- Access only what is required for the agreed task.
- Remove access promptly when a role or engagement ends.
Recommended access controls
MFA
Require multi-factor authentication for users with project access.
RBAC
Grant only the systems and environments required by the role.
VPN where relevant
Use customer-approved secure access for protected environments.
Separate accounts
Do not share credentials between engineers.
Audit logs
Keep access and activity logs in the systems that support them.
Environment separation
Separate development, test and production access according to project needs.
Code and IP
Ownership and usage rights should be defined in the customer agreement before development starts. For custom project work, the agreement should clearly state which code and deliverables become customer-owned and which pre-existing tools, libraries or third-party components remain under their existing licences.
FAQ
Need to review security before an engagement?
We can walk through the intended access model, data flows and delivery responsibilities before any engineer is onboarded.