Trust & Security

We build software for startups and growing businesses in the US, Europe, and Australia, in addition to India. This page explains how we protect your code and data, where client projects can be hosted, and exactly where we stand on compliance — without passing the cost of a certificate we don't have onto you as a claim we can't back up.

Access control

Access to GitHub and client environments requires MFA. Only the engineers actually working on your project get access, and that access is removed once the project ends.

Code security

Every change goes through pull request review. Dependencies are scanned for known vulnerabilities (GitHub Dependabot, npm audit). Secrets are never committed to a repository.

This site's infrastructure

code5x.com runs on Vercel with a Supabase database, both of which encrypt data in transit and at rest as part of their standard service. Traffic is routed through Cloudflare.

People

Engineers and contractors complete identity verification and sign an NDA before joining a client project — separate from the NDA we can sign with you.

Vulnerability disclosure

Found an issue with this site or something we've built? Email security@code5x.com with a description, reproduction steps, and the potential impact. We respond within 2 business days. We don't run a paid bounty program, but we're happy to credit you publicly if you'd like.

Your code and data stay scoped to your project. We don't reuse, repurpose, or reference one client's data while working on another's.

Repositories, CI/CD, and cloud accounts are set up under your organization from the start wherever possible, rather than handed over at the end of a project.

Your project's own infrastructure isn't tied to one provider or region — we build on AWS, Vercel, and similar platforms, and can target the region that fits your requirements, commonly US East/West, EU (Ireland or Frankfurt), or Australia (Sydney). Tell us your preference during scoping.

For this website and our standard project tooling: Vercel (hosting), Supabase (database), Resend (transactional email), Cloudflare (DNS/CDN), GitHub (source code), Google Workspace (business email), Cal.com (scheduling), and Google Analytics (site analytics). A specific client project may introduce additional subprocessors — agreed with you during scoping, never added silently.

For products handling personal data under India's Digital Personal Data Protection Act, we build consent, access-control, and audit-trail work directly into the product. See our DPDP compliance work.

We don't hold formal certifications like SOC 2, ISO 27001, or a GDPR compliance attestation today. A third-party audit is a real cost, and we don't think an early-stage startup should absorb that through higher engineering rates — so instead, we align our practices with common SOC 2 / ISO 27001 control areas (access control, encryption, code review, logging), sign a Data Processing Agreement with every client, and will complete your vendor security questionnaire — including a CAIQ or SIG Lite — on request. If your procurement process requires a certificate today, we may not be the right fit yet; if you want senior engineers, transparent pricing, and straight answers about security, we are.

Security & compliance: security@code5x.com. Sales & contracts: sales@code5x.com. Registered address: 26 Tagore Garden, New Delhi 110027, India. General questions: email kapilan@code5x.com.

Our team works from India (IST), with a US-based contact in Atlanta. That gives a comfortable overlap with Australia (AEST) and a solid one with Europe (CET/GMT) during their afternoon. US calls (EST/PST) don't overlap India's standard hours, so we schedule those for your afternoon or evening and work async-first in between — written updates, not a wait for the next call.