Security & Data Handling

✅ Trust is a stated core value — this section is where that gets enforced operationally, not just stated.

Baseline Rules

• Client data is never stored outside agreed systems (no ad-hoc copies on personal drives/devices).
• Access to client systems/repos is granted per-project and revoked at project close.
• Credentials and API keys are stored in a secrets manager, never shared over chat/email.
• NDAs and data-handling terms are confirmed before any client data is received.

Practical Checklist

• Secrets stored in a secure store (secrets manager or password manager), never in code or docs
• 2FA enabled for critical systems (email, cloud, source control, secrets manager)
• Dependency scanning enabled on active repos
• Backups configured and periodically tested for anything holding client data

Incident Response (Minimum Viable)

1. Identify and contain (revoke access / rotate keys if a credential is exposed).
2. Notify the affected client promptly and honestly — no downplaying.
3. Document what happened, root cause, and the fix.
4. Update this SOP if the incident reveals a gap.