securewebdev.netVerified accounts & MFA
Email verification and multi-factor authentication will protect administrator and client-owner accounts. Account recovery, password resets, and changes to security settings will receive the same attention as signing in.
Security & infrastructure
Security built into your service.
Account protection, separate client environments, reviewed changes, and recovery planning are part of the securewebdev.net security design.
Implementation underway. This page describes the security requirements guiding development. Client accounts, billing, and monitoring are not live yet. These safeguards will be tested before the related services launch.
01 / Client accounts & website changes
Access tied to your account.
Every client workspace will contain only its assigned websites, requests, and billing information. Access will be checked whenever information is viewed or changed.
Separate client records
Permissions and database access rules will restrict each client to their own records. Tests will check that changing a website, ticket, or invoice reference cannot expose another client’s information.
Protected sessions & forms
Encrypted connections, protected login sessions, session expiry, and sign-out controls will help safeguard account access. Forms will validate submissions on the server and include controls against automated abuse and malicious content.
Changes you can review
Request website edits from your dashboard, discuss the scope, and review a preview before publication. Approvals will identify the revision you accepted, with a recorded history of the work.
Payments through Stripe
Stripe-hosted checkout and billing management will handle payment details. Access to invoices and subscriptions will be tied to your client account, and payment updates will be verified before your billing status changes.
Accountability for sensitive actions
Account changes, client assignments, approvals, and billing changes will have restricted audit records. Passwords, login tokens, and payment credentials will be excluded from those records.
02 / Hosting & recovery
Separate client servers.
The hosting design gives each client a separate virtual server, separate credentials, and restricted network access. Maintenance and recovery can then be managed independently.
Server administration will use a separate operations environment. The client portal will handle requests and service information without exposing server administration access.
securewebdev.net · central monitoring
Client ASeparate VPS
Client BSeparate VPS
Client CSeparate VPS
Planned architecture · separate servers and credentials.
Security essentials for every client
HTTPS, security updates, restricted administrative access, and backups are requirements for every managed site. The optional monitoring plan adds monitoring and review services to that baseline.
Off-server backups & recovery checks
Encrypted backups will be stored outside the client server with separate access. Retention, acceptable data loss, and recovery targets will be defined in your agreement. Restore checks will verify that backups can actually be used.
Monitoring with a defined response
The optional service will add review of suspicious logins, file changes, and vulnerability findings. Automated checks and alert delivery will be validated before launch; human review will follow agreed support hours.
Clear service status
Your dashboard will show maintenance, availability, and backup information from connected services, with timestamps. Missing or outdated information will be identified so you can see when a result needs attention.
Maintained infrastructure
Debian is the standard hosting foundation. FreeBSD or OpenBSD can be considered for custom projects after checking application support and maintenance needs. Software updates, access reviews, and recovery procedures will support each environment.
Defined incident procedures
Response procedures will cover investigation, access revocation, recovery, and client communication. Monitoring scope and response targets will be agreed in advance. Extended incident response, penetration testing, and compliance assessments require a separate agreement.
03 / Verification before launch
Security requirements and testing.
The OWASP Application Security Verification Standard (ASVS) 5.0 guides security requirements and testing, with Level 2 as the verification target. OWASP provides an open standard for verifying application security controls.
Test the boundaries
Verification will cover account recovery, permissions between clients, malicious form submissions, and payment failures or repeated notifications. Independent review is planned before a broad release.
Prove recovery & maintain the service
Launch checks will include a demonstrated restore, working alerts, and an invited-client pilot. Security work continues through patching, access reviews, and repeat testing as features change.
ASVS Level 2 is the verification target. Assessment is pending; no OWASP certification or completed compliance assessment is claimed.