Security

We consider identity, permissions, data handling and operational risk during discovery and architecture, not only after development. Controls are selected according to the product, users and information involved.

Solutions may use email and password, one-time codes, protected sessions, biometrics or device capabilities where supported. Authentication choices are matched to the risk and usability needs of the product.

Role-based access, server-side permission checks and PostgreSQL row-level policies help ensure users can view and perform only the actions intended for their role. Sensitive administrative operations receive additional verification, logging and separation where appropriate.

We use encrypted connections, controlled database and storage access, responsible credential handling and provider security capabilities appropriate to the project. Public application keys are treated differently from server secrets, which should remain in protected runtime environments and never be embedded in a distributable client.

Backup, recovery, geographic processing and retention needs are defined with the client and relevant service provider. Highly sensitive fields may require additional application-level protection or a specialised service.

Client applications are designed to keep privileged logic and secrets away from the distributable interface. Session tokens and local preferences use platform-appropriate storage, network requests use encrypted transport, and release configurations are separated from development settings.

Device biometrics can protect access on a device but do not replace server-side authorization. Push notification content should avoid unnecessary sensitive information because delivery may involve operating-system and messaging providers.

Applications may include logs, status history, database audit records, delivery events, error reports and administrative visibility for important actions. Logs should minimise personal or secret data and follow an agreed retention period. The right level of monitoring depends on the operating environment and support plan.

Security is shared. Clients should use strong credentials, review user access, protect devices, keep contact details current, apply recommended updates and notify us quickly when suspicious activity is discovered.

If you believe you found a vulnerability in a Wyns Technology-managed system, email register@wynstechnology.com with a clear description and steps to reproduce. Do not access unrelated data, disrupt service or publicly disclose the issue before we have had reasonable time to investigate.