Security reviews evaluate project code, infrastructure configurations, and data handling practices to identify vulnerabilities before release or integration. All evaluations are coordinated between the Technology department and Operations & Client Services during normal working hours.
Reviews ensure that bespoke web builds, software integrations, and technical assets comply with agreed functional constraints and baseline digital hygiene.
Review intake and submission
Security review requests must be initiated through the Ask Xylo chat on this portal. Requests can be submitted alongside a project brief or triggered as an independent review stage within an ongoing technical development package.
When requesting a security assessment, the client must supply:
1. Target environment credentials, access scopes, and repository links. 2. Documentation covering technical architecture and third-party data services. 3. Applicable regulatory or compliance criteria (such as GDPR expectations or sector-specific frameworks). 4. Any third-party penetration testing vendor forms or compliance questionnaires requiring studio completion.
Operations & Client Services logs the request and issues an initial response within our 24-hour first reply target. If the review is part of a custom engagement rather than a standard delivery milestone, a bespoke quote is supplied within 48 hours of receiving the complete technical documentation.
Operational sequence
The review process follows a strict sequence conducted by the Technology department:
1. Boundary and Scope Verification: Engineers verify that access permissions are isolated to development or staging environments. Production credentials are not accepted for exploratory security audits. 2. Static Code and Dependency Analysis: The Technology department audits repositories for outdated dependencies, known vulnerabilities (CVEs), hardcoded secrets, and unsafe execution paths. 3. Access and Environment Auditing: Cloud environments, database rules, and API endpoints are verified for least-privilege configurations, encrypted transit protocols, and proper authentication layers. 4. Questionnaire and Vendor Sign-Off: Operations & Client Services completes client-supplied vendor security questionnaires based on the technical findings and verified configurations. 5. Reporting: A formal remediation document is generated detailing critical items, warnings, and verified security controls.
All reviews run strictly during studio working hours, Monday to Thursday, between 09:00 and 17:00 GMT.
Departmental responsibilities
The Technology department is solely responsible for technical analysis, static analysis tooling, server configuration checks, and verifying third-party code libraries. Engineers also author the technical remediation notes.
Operations & Client Services handles operational coordination. This includes vetting external vendor questionnaires, tracking review milestones, relaying written findings, and confirming delivery dates.
Where the project originated via a referral, the standard 10-30% referral discount applies to review fees if agreed and confirmed in writing on the original quote, while the referrer earns commission via the ambassador programme.
Remediations and failure cases
If critical vulnerabilities or structural security flaws are uncovered, work does not automatically proceed to deployment. The sequence for handling flagged items is as follows:
- Internal Deliverables: If vulnerabilities are found within custom code built directly by the Technology department within the current project scope, the studio prioritises and patches the issue within the existing sprint parameters.
- Third-Party or Legacy Dependencies: If issues stem from external client libraries, third-party software, or legacy hosting chosen by the client, the studio documents the risks and pauses deployment until the client provides alternate tooling or instructs remedial changes.
- Unresolved Questionnaires: If a client vendor questionnaire requires certifications or hosting standards outside the project brief, the review is placed on hold until amended scopes or replacement requirements are agreed in writing.
Deposits are non-refundable once your production slot is held. Before work begins, sums not yet earned are refunded pro rata; after work begins, completed work and booked time are charged. Defects are fixed free of charge within the acceptance window. The full terms are on the Refund Policy page of the main site. Discretionary exceptions occur exclusively at the studio's sole discretion.
Security review checklist
Before initiating a security review via Ask Xylo, ensure the following steps are complete:
- Staging or test environment access is provisioned without live production data.
- All relevant architectural documentation and integration schemas are attached to the brief.
- Third-party questionnaires or compliance forms are supplied in an editable document format.
- Repository read access is confirmed for the Technology department.
- Technical points of contact on the client team are designated for fast resolution of permission blocks.