Practical safeguards
Our approach to protecting project information, handling access and agreeing appropriate security responsibilities with clients.
Last reviewed: 25 October 2026 · LiMiT.agency
Security approach
Security starts with clear ownership, minimal access and defined responsibilities. For website, software and marketing projects, controls are selected according to the nature of the work, hosting environment, sensitivity of information and contract requirements.
No system is completely risk-free. This page does not claim external certifications, penetration-test results or a guaranteed absence of vulnerabilities.
Credentials and access management
- Prefer individual accounts, appropriate access roles and multifactor authentication where supported.
- Share credentials through an agreed secure method, not a public form or public repository.
- Restrict access to the systems needed for the task and review access on completion.
- Separate production and development environments where feasible, and avoid unnecessary copies of personal data.
Updates, monitoring and recovery
Depending on the accepted scope, services may involve code review, updates, logging, backups, vulnerability remediation, recovery planning or production monitoring. The exact backup frequency, retention, recovery targets and incident response commitments must be documented in a maintenance or hosting agreement; they are not universal guarantees across all client projects.
Personal data in client projects
For some projects, the customer remains the controller of its own end-user data and the contracted LiMiT entity may act as processor. The legal roles follow the actual purposes and instructions. Where required, processing must be covered by a suitable Article 28 data-processing agreement specifying instructions, subprocessors, security and assistance duties.
Clients should avoid supplying production datasets or credentials until access requirements and retention arrangements have been agreed.
Hosting, AI and external providers
Projects can depend on hosting vendors, cloud infrastructure, email, analytics, advertising platforms, external APIs or AI services. Use of such providers, data locations, confidentiality commitments, licensing and international transfers should be assessed per engagement and documented when material.
Reporting and escalation
Report a suspected vulnerability, unauthorised access or exposure involving a LiMiT.agency project to [email protected]. Include a description and a safe contact method; do not publish exploit details or credentials. Incident notification and cooperation obligations follow applicable law and the relevant agreement.
Related information
For personal information submitted through this site, see the Privacy Policy. For scope-specific security commitments, refer to the project agreement, any SLA and any data-processing agreement.