Security
GujjuTicks builds custom apps, websites, and software with practical security defaults: HTTPS, careful access, sensible backups, and ownership you control — not buzzwords or certificates we have not contracted for.
This page describes how we work day to day. It is not a legal warranty or a compliance attestation.
We treat security as part of delivery: authentication and roles where needed, hardened hosting basics, least-privilege access during build, and a clear handoff of credentials and repos at launch. Higher compliance (HIPAA, PCI, SOC2) is scoped only when the project requires it.
HTTPS
Default for live sites
Roles
Auth when the product needs it
Handoff
You keep access & ownership
Scoped
Extra compliance when required
TLS/HTTPS for production sites, sensible environment separation, and hosting choices matched to the product — not a one-size vendor pitch.
When the product needs accounts, we design login, roles, and permission boundaries as part of the build — not as an afterthought plugin.
Project credentials and deploy access are limited to people who need them. We prefer shared vaults / password managers over chat paste.
For apps we host or help host, we plan basic backup and restore paths appropriate to the stack. Exact RPO/RTO is agreed per project.
We keep frameworks and packages on maintainable versions and discuss security updates as part of launch and optional ongoing support.
Repos, hosting panels, domains, and credentials are handed over per written terms. We design for handoff, not lock-in.
Some industries need formal audits, penetration tests, or regulated handling of data. We can participate or coordinate — those are explicit line items, not assumed in every website or MVP.
Tell us early what data you store and which rules apply. We will either design within a practical bar, recommend specialists, or decline work we cannot support honestly.
Security is ongoing. Optional maintenance retainers cover patching, monitoring basics, and small hardening tasks — see Ongoing support under Services.
Have compliance constraints?
Share them in your brief — we will say what we can own and what needs a specialist.