Quality you can
check, not just
take our word for.
Named industry standards, written specs and automated gates behind every change we ship. All of it visible in your own tools.
Industry standards
The frameworks
we build against.
We align our work to these published standards and can show the evidence. We do not claim certifications we do not hold.
| Standard | Area | How we apply it |
|---|---|---|
| ISO/IEC 25010 | Software quality model | Reliability, security, maintainability and performance as named, testable quality attributes agreed per project. |
| OWASP ASVS 4.0 (L2) | Application security | Verification checklist for authentication, access control, input handling and data protection. |
| OWASP Top 10 for LLM Apps | AI application security | Tests for prompt injection, insecure output handling, data leakage and excessive agent permissions. |
| NIST AI RMF 1.0 | AI risk management | Map, measure, manage and govern risks for every AI feature, recorded in a risk register. |
| WCAG 2.2 AA | Accessibility | Keyboard access, contrast, focus order and screen-reader labels checked before release. |
| DORA metrics | Delivery performance | Deployment frequency, lead time, change failure rate and time to restore, tracked and shared. |
| SLSA + SBOM (CycloneDX / SPDX) | Supply chain | Reproducible builds, pinned dependencies and a software bill of materials on every release. |
| OpenTelemetry | Observability | Vendor-neutral traces, metrics and logs, including model calls and agent tool use. |
Every change
Five gates
before merge.
Lint, type check, tests, dependency scan and secret scan. If one fails, the change goes back. No exceptions for deadlines.
Technical specs
The defaults
on every project.
Targets are agreed per project. These are the baseline we start from.
- Code review
- Every change merged via pull request with at least one senior reviewer. No direct pushes to main.
- Automated tests
- Unit, integration and end-to-end suites in CI. Coverage target agreed per project; critical paths covered first.
- CI gates
- Lint, type check, tests, dependency and secret scanning must pass before merge.
- AI evaluation
- Versioned eval sets with pass thresholds for accuracy, refusal and safety. Run on every prompt or model change.
- Performance
- Core Web Vitals at 'good' (LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1) for web front ends; p95 latency budgets for APIs.
- Releases
- Semantic versioning, changelogs and a tested rollback path for every production deploy.
- Environments
- Separate dev, staging and production. Infrastructure as code; no manual production changes.
- Secrets
- Stored in a managed vault, never in code, prompts or logs. Rotated on engagement end.
- Documentation
- Architecture decision records, runbooks, setup guide and known limitations kept in your repository.
Definition of done
Done means
all four.
Meets the acceptance criteria
Agreed in writing before work starts, demonstrated in your environment.
Reviewed and tested
Passed review and every CI gate. AI features passed their eval thresholds.
Observable
Logs, metrics and alerts in place, with a named owner for each alert.
Documented
Someone who wasn't in the room can run, change and roll it back.
Before we start.
Are you certified against these standards?
No. We align our work to them and can show the evidence. We do not claim certifications we do not hold.
Can you work to our own standards instead?
Yes. Where you have your own engineering, security or accessibility standards, those take priority and we map our checks to them.
Do these standards slow delivery down?
Most checks are automated in CI, so they run on every change without extra meetings. They catch problems when they are cheap to fix.
How do we see the evidence?
In your own tools: pull request reviews, CI results, eval reports and the documentation in your repository.
What coverage target do you use?
It is agreed per project. We prioritise meaningful tests on critical paths over a headline percentage.
The next step
Hold us to
the standard.
Tell us what you're building and the standards it has to meet. We'll show you how we'd prove it.