Security & Compliance

If you are evaluating us as a supplier, this page is written for you rather than for a search engine. It covers how we handle access, intellectual property, confidentiality, and incidents — and it states plainly which certifications we hold, which is none. Send us your questionnaire and we will work through it.

Working in your environment

Client work happens inside your systems, not ours. That single decision determines most of what follows: your controls apply, your audit trail captures the activity, and you can revoke access without asking us to act.

We work inside your systems, under your controls

Our people are provisioned as named individuals in your identity provider, your repositories, and your ticketing — never through shared or generic accounts. Access follows least privilege: what the role requires, and nothing beyond it. You retain the ability to audit and revoke that access at any moment, without going through us.

Access ends when the engagement or the person does

Offboarding is part of the engagement, not an afterthought. When someone rolls off, we notify you and confirm removal from every system they were granted. We would rather you also run your own revocation check than take our word for it.

Confidentiality binds every individual, not just the company

Everyone assigned to your work is under written confidentiality obligations that survive the end of their involvement. We will sign your NDA in addition to our own terms, and we will sign your data processing agreement where your regulatory position requires one.

You own everything produced for you

Our engagement agreements assign all intellectual property in the work product — source code, documentation, and design files — to you. We provide that assignment language up front for your counsel to review, before any work starts, rather than leaving ownership to be argued about later.

Your data stays in your infrastructure

Client work happens in your repositories, your cloud accounts, and your tooling, so data residency follows your infrastructure rather than ours. We avoid taking copies of production data; where a task genuinely requires realistic data, we ask for it to be anonymised or synthetic first.

We will complete your vendor security review

Send us your security questionnaire, your required controls, or your architecture review process and we will work through it. If your requirements exceed what we currently do, we would rather tell you and agree a path than sign something we cannot honour.

Incidents are reported to you, promptly and in plain terms

If we become aware of an incident touching your systems or your data, we tell you without waiting to have the full picture, and we keep telling you as we learn more. We would rather deliver an early, incomplete report than a late, tidy one.

What we do not hold

We do not currently hold an ISO 27001 certification or a SOC 2 attestation, and we are not going to imply otherwise. If your procurement process requires one, tell us early so nobody wastes time. What we can do is work to your controls, complete your review, accept your contractual security terms, and give you named accountability for every person on your account.

This website, specifically

Everything in this section is a property of the code running this site, and is verifiable from the outside — you do not have to take our word for any of it.

This site holds no accounts and no customer data

There is no login, no user database, and no stored credentials anywhere in this website. Almost every page is a static file generated at build time. The only endpoint that accepts input is the contact form, which means the surface an attacker can reach is a single POST route.

No cookies, no analytics, no third-party scripts

This site sets no cookies. It loads no analytics, advertising pixels, session recorders, or tag managers, and it requests no resources from third-party servers — fonts included, which are served from our own origin. Nothing about your visit is recorded unless you choose to submit the form.

The contact form validates on the server

Submissions are validated server-side against the same rules the browser applies, so client-side checks cannot be bypassed. Fields are length-capped, the service field is checked against a fixed list, and only known fields are stored — anything else in the payload is discarded rather than persisted.

Automated abuse is rate limited

The endpoint applies a per-IP request limit, a hidden honeypot field, and a minimum completion time. Spam is accepted and discarded rather than rejected, so a bot receives no signal to retry differently. Oversized payloads are refused before parsing.

A failed submission is never reported as a success

If an inquiry cannot be delivered to its configured destination, the endpoint returns an error, logs the failure, and tells the visitor. It does not display a confirmation for a message it did not store.

Data collected is minimal, and its use is stated

The form collects a name, email address, optional company, service category, and message — nothing more, and no sensitive personal data. It is used only to respond to the enquiry. We run no marketing lists and sell no personal data. Full detail, including how to exercise your ARCO rights under Mexican law, is in our privacy notice.

Dependencies are audited before release

Every release is gated on a clean lint pass, a passing test suite, a successful production build, and an audit that fails on any known high-severity advisory in a production dependency. A vulnerable package does not reach the site unnoticed.

Questions we get from procurement

Where is our data stored?: In your systems. Engagements run inside your repositories, cloud accounts, and tooling, so residency and retention follow your infrastructure and your policies rather than ours. The only data we hold independently is the contact-form submission that started the conversation.
Who has access, and how do we verify it?: Named individuals only, provisioned by you in your identity provider. Because you grant the access, you can audit and revoke it directly at any time, without a request to us. We will provide the current roster on your account whenever you ask.
Do you subcontract any of the work?: The people on your account are ours, and we will tell you plainly if that would ever change for a specific engagement. You will not find an undisclosed third party in your systems.
What happens to code and documents when we finish?: The work product is already yours and already in your systems. At the end of an engagement we confirm access removal and delete any local working copies. If you want written confirmation of that for your records, ask and we will provide it.
Can you sign our DPA and our NDA?: Yes to both. We will also review your security addendum. If a specific clause is something we cannot honour operationally, we will say so during review rather than sign and hope.

Reporting something to us

If you believe you have found a vulnerability in this site or in work we have delivered, please tell us at info@sofely.io. Include enough detail to reproduce it. We will acknowledge the report, keep you updated, and we will not pursue anyone who reports in good faith and does not access or modify data belonging to others.

Our privacy notice covers personal data and your ARCO rights under Mexican law. Our terms of use cover this website. Commercial terms, including intellectual property assignment, live in the engagement agreement rather than on this site.