Security & trust
The words 'enterprise-grade' should survive questioning.
This page exists for the person on your side whose job is to ask what our claims actually mean. Here is how we host, secure, and hand over what we build, in enough detail to be checked.
Infrastructure & hosting
- Platforms run on modern managed cloud infrastructure that we set up, monitor, and keep patched as part of the monthly fee.
- Websites are hosted on Vercel with content in Sanity, billed through at cost with no markup.
- Accounts are opened in your name wherever practical: the repository, the infrastructure, and the domain are yours from day one, with us as operators rather than owners.
- Changes are built and reviewed away from production before they reach your team.
Access & security
- Sign-in goes through the identity you already manage, with single sign-on against Microsoft 365 / Entra ID, so access is granted and revoked in one place.
- The platforms we build carry role-based access and audit trails on every write, because that is the evidence a security review actually asks for.
- Traffic is encrypted in transit everywhere, and data at rest sits in managed services that encrypt by default.
- Our own provider accounts use multi-factor authentication, and access to your systems is limited to the people working on them.
- Security patching and dependency updates are continuous and included in the fee. 14 years of running security for other people's businesses made us conservative on purpose.
Availability & backups
- Hosting, uptime monitoring, and alerting are part of every plan, so a problem pages us rather than waiting for your staff to notice.
- Backups run on every care plan and platform we operate, and data stays exportable: your database is yours to take at any time.
- When something breaks, you talk to the people who built it. There is no ticket queue between you and the person who can fix it.
How we use AI
- AI accelerates our engineering; architecture, security, code review, testing, and deployment stay in senior human hands. AI-written code ships only after a person has reviewed it.
- Where AI runs inside your platform, we use business-tier model providers that do not train on your data.
- We send a model the minimum a task requires and keep an audit trail of what was processed.
- Model and token costs are billed through at cost, so you can always see what AI usage actually was.
How we build
- Boring, mainstream, battle-tested technology that any future developer can maintain. Innovation goes into your business results, not our stack choices.
- Work ships in two-week cycles with a review you attend, so nothing reaches production that your team has not already seen working.
- Roles, permissions, and audit logging are designed in from the start rather than bolted on for an assessment.
- Documentation and team training are part of the engagement, not an add-on.
What we don't claim
We do not hold SOC 2 or ISO 27001 certification, and we will not imply otherwise. What we will do is answer specific security questionnaires specifically, walk your IT people through how a system is built, and put the commitments that matter to you in the agreement. If your procurement requires a particular attestation, raise it on the first call and we will tell you plainly whether we can meet it.
For sectors with their own regimes, like CMMC in the defense supply chain or WCAG 2.1 AA for public bodies, we build to the standard and say exactly what that does and does not mean.
If GO Build Labs disappeared tomorrow
The honest test of a software partner is what leaving them costs. Because everything is in your name from day one, you would still have:
- Your GitHub repository, with every commit we ever made
- Your production infrastructure and the accounts it runs in
- Your database and a full export of your data
- Your domain and DNS
- Your documentation
- Your deployment configuration
A departing client gets a transition call with whoever takes the work on, at no charge. Any competent developer can pick up a mainstream, documented codebase, and making sure that stays true is one of our working principles. The easier we make it to leave, the harder we work to make you stay.
Put your IT people on the call.
Security questions go better with the people who will actually run the system in the room. Bring yours; the people answering are the ones writing the code.
One monthly fee · Built, hosted & improving · You own the custom code