Security is decided by architecture long before it is decided by tooling. Where permissions are enforced, what is logged, and who can reach what — those choices are made early and are expensive to reverse.

On the platforms we build, that means access control applied at the data layer rather than filtered on output, mandatory identity verification where money or high-value goods move, audit trails that survive a dispute, and secrets that never sit in a repository.

On the UK bullion platform we deliver, identity checks are mandatory before a transaction completes, because in that market they are a legal condition rather than a feature.

To be exact about scope: we secure what we build and we harden what we run. We are not a managed security operations provider, and we will tell you when a specialist firm is the right answer instead.

• Essential cybersecurity practices for your business