Security you
can inspect.
Your systems deserve more than a promise.
Government software needs protection in the application, the infrastructure, and the way it is operated. We build across all three. See our controls, explore the requirements behind them, and compare the results with the software you use today.
Talk through your security requirementsStart with
what is proven.
See the safeguards we built into ByteWish, how we support client systems, and the results of checks on our public website and email.
- In the application
- ByteWish shows identity checks, organization-specific permission, encrypted financial fields, and protected IRS integrations. See implemented controls
- In operation
- Clients have assigned 24/7 emergency support, including holidays, and Azure point-in-time backups. Recovery terms are set for the specific system. See support and recovery
- In public reports
- Published reports cover our production website and company email. We also publish results from the website build scan. Open the public measurements
Security lives
in the workflow.
We build controls around the people, decisions, and information in each system. Identity alone is not enough: the application must check what a person can do, protect sensitive records, and authenticate the services it relies on.
Implemented in the ByteWish financial application
These safeguards protect the payroll and tax workflows we built for ByteWish.
- Authority for each action
- Microsoft sign-in is followed by person and organization checks. Form 990-PF transmission requires an administrator in the selected organization; employee W-4 self-submission requires a verified passkey assertion.
- Protection for financial records
- Bank details, taxpayer identifiers, and selected tax-form fields are encrypted by the application alongside its access controls.
- Authenticated service connections
- Azure managed identity supplies server-side tokens for MeF services. The Form 990-PF workflow validates XML against the selected IRS schema before packaging and transmission.
Evidence belongs
in the delivery.
A release should show more than a list of features. We define the system boundary, test the decisions that matter, and connect the results to the version being delivered.
- Define the boundary
- Identify the people, permissions, information, service providers, and operating responsibilities that a system's controls must cover.
- Exercise the consequential paths
- Test authorization, validation, integrations, and failure handling around the real workflow. ByteWish's tax-form process and organization-specific permissions show this in application code.
- Make results inspectable
- We publish dated browser, accessibility, performance and security results for this website. See the website validation report.
Requirements belong
in the software.
We turn your requirements into controls, tests, and evidence for the information your system handles and the people using it.
We build on Azure Government for FedRAMP High requirements, enforce application controls, and tie test evidence to releases.
- Government cloud and contracts
- FedRAMP High, GovRAMP, TX-RAMP, CMMC and NIST SP 800-53. See requirements and evidence.
- Application security and secure delivery
- OWASP ASVS, NIST SSDF, CIS Controls and NIST CSF. See requirements and evidence.
- Accessible public services
- WCAG 2.2, Section 508, ADA Title II and EN 301 549. See requirements and evidence.
- Sensitive and regulated government data
- NIST SP 800-171, CJIS and IRS Publication 1075. See requirements and evidence.
Place each system
in the right environment.
We choose hosting, identity, storage and monitoring for each deployment's needs.
Environments and service responsibilities
- Azure Government
- We build on Azure Government for FedRAMP High requirements, with application controls and operating responsibilities established for the agency's system. Explore the government requirements.
- Azure Commercial
- We also build on Azure Commercial. ByteWish's MeF integration is a concrete example of Microsoft identity and server-side Azure managed identity connecting an application to protected services.
- Cloudflare
- Cloudflare serves our public website.
- Microsoft 365 and Teams
- Microsoft 365 supports company email and team communication.
- Self-hosted monitoring
- Self-hosted Sentry tracks application errors. Public endpoint availability is visible through the status page. Check service status.
Ready for the
workday.
And after it.
Government services keep working after the office closes. Existing clients have assigned emergency support at any hour, including holidays.
View service status- Assigned emergency support
- Clients use their assigned contact for urgent incidents. Report a suspected vulnerability to Security@DevelopingToday.net. See support coverage.
- Point-in-time backups
- Azure point-in-time backups support recovery of client data. Recovery targets and restore exercises are set for each system.
- Operational visibility
- We monitor public endpoint availability and use self-hosted Sentry for application errors. Coverage for a client system is defined in its operating plan.
- Hosting fit to the system
- We work with Azure Government, Azure Commercial and Cloudflare. The services and responsibilities are selected for the deployment. We are an authorized Azure Government reseller. View our profile on Microsoft Marketplace.
Recovery is a working plan.
Azure point-in-time backups and assigned 24/7 emergency support provide a foundation. For each client system, we work through the recovery targets, responsibilities and steps needed to bring the service back safely.
- Restore the service
- Plan for the application, records, identity, configuration and integrations together. A database restore alone may not return a usable service.
- Test the return
- Agree recovery time and data-loss targets, then record restore exercises and verify the workflows people need before resuming.
- Know who acts
- Define escalation, incident decisions, communications and client approval for the system. Existing clients have assigned emergency support at any hour, including holidays.
A record of staying available.
100% monitored availability for www.developingtoday.net and sdlegislature.gov, April 22, 2022 through September 28, 2026.
Better Stack checked both public endpoints every ten minutes. South Dakota LRC hosts its system following our recommendations.
See the availability recordPublic security
results.
See the independent reports for our production website and company email, plus the scan we run on the website build before release.
Your data.
Your source code.
Your control.
You own your source code and data. Full end-user exports and a full-featured OpenAPI specification are standard in our systems.
Ownership and deliveryPrivacy in practice.
This website uses no advertising or analytics scripts. Our privacy policy explains hosting, operational information, self-hosted error monitoring, and how we handle inquiries.
Read the privacy policyTalk with the engineers responsible.
Send us your security requirements or questionnaire. Our engineering team will review access, data protection, hosting and support with you.
Arrange a security review Expect more
from your software.
Tell us about the system you need to build or improve. We'll discuss the work, security requirements and support it needs.
Discuss your projectReport a security issue
Send the affected address, what you observed, and steps to reproduce it. Contact us first to arrange a secure way to share sensitive details.
Security@DevelopingToday.net 605-610-2992