Security

Security is a core part of how we build, for our own systems and for the infrastructure we design for clients. We hold ourselves to the same standards we put in place during client audits: least-privilege access, encryption by default, and policy-as-code guardrails wherever practical.

Data submitted through this website is transmitted over encrypted connections (TLS). Access to any data we hold is restricted to team members who need it to do their work, and access is reviewed periodically.

Our own infrastructure follows the same practices we recommend to clients: multi-factor authentication on all administrative access, infrastructure changes made through code review rather than manual console changes, and centralized audit logging for anything that touches production systems.

If you believe you've found a security vulnerability in this website or our systems, we want to know. Email info@creedops.com with details and, if possible, steps to reproduce the issue. We'll acknowledge reports promptly and keep you updated as we investigate and remediate.

Please report vulnerabilities privately and give us a reasonable window to address an issue before any public disclosure. We don't pursue legal action against good-faith security research conducted under this policy.

Security requirements and controls for a specific client engagement (including any compliance framework such as HIPAA or SOC 2) are defined in that engagement's contract and scope, and may exceed the baseline practices described here.