What you send us
Your name, email, phone number, business details and project requirements.
How we protect your information, payments and projects, in plain language, with nothing we can’t stand behind.
Our website is served over HTTPS, and HSTS tells browsers to insist on it.
Rate-limited sign-ins, hashed passwords, and two-step login with an authenticator app.
You pay on Paystack’s hosted checkout. We never see or store your card number.
We are a small team, and we handle things you would rather keep private: your enquiries, your business plans, the access you give us to your website, and sometimes your payments. We try to earn your trust by being specific about what we do, and honest about what we don’t.
This page explains what we do to protect your information and the systems we build, what we ask of you, and where our limits are.
“We describe what we actually do, not what sounds impressive. If we can’t point to it, we don’t claim it.”
Four kinds of information pass through our hands, and each gets its own protections:
Your name, email, phone number, business details and project requirements.
Logins, hosting or domain access we need to do the work.
The stages, milestones and notes in your client portal.
Which payments were requested and whether Paystack confirmed them.
Our team manages messages, blog posts and client projects through a private dashboard. These are the protections around it and around this website:
The site is served over HTTPS with HSTS. Extra security headers stop browsers from guessing file types, block the site from being framed by other sites, limit what is sent to other sites when you click a link, and switch off camera, microphone, location, payment and USB access that we never use.
Super admin, partner and admin accounts each see only what they need. An admin, for example, cannot open messages, and the server refuses the request even if someone tries to call it directly. Hiding a menu item is not the only barrier.
Passwords saved in our database are hashed with scrypt, never stored as plain text. Login cookies are signed, HttpOnly and SameSite-strict. Repeated failed sign-ins are rate-limited.
The super admin and partners can protect their accounts with an authenticator app and one-time recovery codes.
The dashboard signs out after two minutes without activity by default, and no session lasts longer than 12 hours.
Sign-ins (new devices are flagged), password changes, deletions and backups are recorded so we can spot anything unusual. The log never records passwords, codes, IP addresses or message text, and entries expire after 180 days.
Blog content is cleaned on the server so only approved formatting survives. Uploaded images must be genuine image files. Public forms are rate-limited and include a hidden trap that catches automated spam.
Every project can have a private portal where you see the current stage, the milestone checklist and any payments due. It does not need an account. It works through a private link that is long and randomly generated, so it can’t be guessed.
Portal pages are hidden from search engines, are not stored in browser caches, and do not pass the link on to other sites.
A strict content policy limits what the page is allowed to load or send.
We can replace your link at any time, which immediately stops the old one working.
Because the link is the key, anyone who has it can view your project. Share it only with people who should see it, and tell us if it reaches someone it shouldn’t.
We collect payments through Paystack. You can pay by card, Apple Pay or M-PESA where available, on Paystack’s own checkout page. Our site and dashboard never receive your card number.
The full detail is in our Privacy Policy. In short:
Saved in our inbox, and an email notification reaches us through our form provider, Web3Forms.
Saves a question only when it can’t answer it. Email addresses, phone numbers and links are removed first, no name or IP address is kept with it, and the question is deleted automatically after 90 days.
We store your email, your first name if you give it, the page you signed up on and the date. You can ask us to remove you at any time.
Please don’t send passwords or card numbers through ordinary forms or chat. If we need access from you, we will tell you the secure way to share it.
What we do for ourselves, we try to do for the sites and software we build:
You can see how security fits into each stage of a project on our How We Build page, or read about our IT and security work.
No system is perfectly secure, and anyone who tells you otherwise is selling something. We can’t promise that a website or application will never be attacked. We can promise to build carefully, keep things updated, and tell you plainly if something goes wrong that affects you.
We also rely on other companies. Our hosting, database, payments and form delivery are provided by third parties, each with their own security practices. We choose them carefully, but we don’t control them. We list only the protections we run ourselves, not security badges or certifications.
If you think you’ve found a weakness, received a suspicious message that appears to come from us, or noticed something wrong with your project or payment, please tell us. Email codesmith.sc@gmail.com with the subject “Security concern” and include:
What you saw, and the page address where you saw it.
The steps that lead to it, so we can see it too.
How to reach you if we need more detail.
Please look only at your own information, and don’t change, delete or download other people’s data while checking. We read every report, confirm that we have received it, and let you know what we find.
Ask us anything about how we handle your data, access or payments. We would rather answer now than have you wonder later.
Code Smithers: technology, software development, and digital solutions for businesses and entrepreneurs.Tell us what you want to build, improve or solve. We can help turn the requirement into a practical digital solution.