Commissioning software? These twelve questions separate systems that stay safe from systems that become tomorrow's data breach. Ask them before you sign — and again before you go live.
- Who can see what? Roles and permissions are defined in writing and enforced on the server, never only in the browser.
- Is tenant data isolated? In shared platforms, every query is scoped to the right organisation, and that is tested automatically.
- Are all inputs validated? Forms, uploads and APIs reject anything unexpected.
- Are passwords handled properly? Strong hashing, multi-factor authentication for admins, and rate-limited logins.
- Are secrets kept out of code? API keys and passwords live in protected configuration, not in the repository.
- Is personal data minimised? Only what is needed is collected, with retention periods that match your GDPR records.
- Is there an audit trail? Important actions are logged with who, what and when — without logging sensitive data itself.
- Are file uploads safe? Type and size checks, storage outside the web root, and no direct execution.
- Are backups tested? A backup you have never restored is a hope, not a backup.
- Is there a rollback plan? Every release can be reversed quickly if something goes wrong.
- Is it accessible? Public-facing services should meet WCAG 2.1 AA so everyone can use them.
- Has it been independently tested? A penetration test before launch, and a re-test after fixes.
Why this matters more in the public sector
Public bodies hold data citizens cannot opt out of giving. Accessibility, transparency and auditability are not extras — they are part of the service. The same discipline protects private companies from fines, lost contracts and reputational damage.
Need a second pair of eyes on a specification or an existing system? Ask Vimal for a review.