Security & trust
'Enterprise-grade' should hold up when someone asks what it means.
This page is for the person on your side whose job is to ask what our claims mean in practice. It covers how we host, secure and hand over what we build, in enough detail to check.
Hosting
- Platforms run on modern managed cloud hosting that we set up, monitor and keep patched as part of the monthly fee.
- Websites are hosted on Vercel with content in Sanity, billed through at cost with no markup.
- Accounts are opened in your name wherever practical. The account holding the code, the hosting and the domain are yours from day one, and we run them for you rather than owning them.
- Changes are built and reviewed separately from the live system before they reach your team.
Access & security
- Sign-in goes through the accounts you already manage, using your Microsoft 365 / Entra ID sign-in, so access is granted and removed in one place.
- The platforms we build control what each role can see and do, and keep a record of every change, who made it and when, because that's the evidence a security review asks for.
- Traffic is encrypted in transit everywhere, and data at rest sits in managed services that encrypt by default.
- Our own provider accounts use multi-factor authentication, and access to your systems is limited to the people working on them.
- Security patches and software updates are ongoing and included in the fee. 14 years of running security for other people's businesses made us careful on purpose.
Availability & backups
- Hosting, uptime monitoring and alerts are part of every plan, so if something goes wrong, we get alerted instead of waiting for your staff to notice.
- Backups run on every care plan and platform we operate, and data stays exportable: your database is yours to take at any time.
- When something breaks, you talk to the people who built it. There is no ticket queue between you and the person who can fix it.
How we use AI
- AI speeds up our engineering, but senior people stay in charge of how the system is designed, its security, code review, testing and putting changes live. Code written with AI goes live only after a person has reviewed it.
- Where AI runs inside your platform, we use business-tier model providers that do not train on your data.
- We send a model only what a task needs and keep a record of what was processed.
- Model and token costs are billed through at cost, so you can always see what your AI usage was.
How we build
- Mainstream, well-proven technology that any future developer can maintain. We keep the clever ideas for your business problems and stick to well-known tools.
- Work is delivered in two-week cycles with a review you attend, so nothing goes live that your team hasn't already seen working.
- Roles, permissions and a record of who did what are planned in from the start, not added later for an assessment.
- Documentation and team training are included as part of the work.
What we don't claim
We do not hold SOC 2 or ISO 27001 certification, and we won't imply otherwise. What we will do is answer your security questionnaires point by point, walk your IT people through how a system is built, and put the commitments that matter to you in the agreement. If your procurement requires a particular attestation, raise it on the first call and we'll tell you plainly whether we can meet it.
For sectors with their own rules, like CMMC in the defense supply chain or WCAG 2.1 AA for public bodies, we build to the standard and say exactly what that does and does not mean. Our own accessibility statement shows the same test we run on client work, pointed at this site.
If GO Build Labs disappeared tomorrow
A fair test of any software partner is what it costs to leave them. Because everything is in your name from day one, you would still have:
- The GitHub account holding your code, with every change we ever made
- Your live hosting and the accounts it runs in
- Your database and a full export of your data
- Your domain and DNS
- Your documentation
- Your settings for putting changes live
A departing client gets a transition call with whoever takes the work on, at no charge. Any competent developer can pick up mainstream, documented code, and keeping it that way is one of our working principles. We'd rather make leaving easy and give you reasons to stay.
Put your IT people on the call.
Security questions go better with the people who will run the system in the room. Bring yours. The people answering are the ones writing the code.
One monthly fee · Built, hosted & improving · You own the custom code