Skip to content
Security

Your code, read-only, under a signed NDA.

Giving someone access to a store that makes money is a real decision. This is exactly what I need, how to grant it safely and what happens to it afterwards.

  • Signed before accessNDA and data processing agreement are part of the agreement you sign at checkout. Nothing is accessed before that.
  • Read-only for the auditThe audit needs to read code, not change it. No production changes, no deploys.
  • No customer dataNo production database. If data is needed, an anonymised copy is used.
  • Personal, revocable accessOne named account, 2FA on. Anything that has to be a secret reaches me through the secure drop: sealed in your browser with my public key, readable only on my machine, never by email. You can revoke it any time.
  • Removed on deliveryAll access and local copies of code deleted within 5 working days of delivering the audit, confirmed in writing.
  • EU company, EU dataInvoiced by V.DEV d.o.o. in Croatia. Records hosted in the EU. Work stays in your own tools.
How to grant access

The minimum, per platform.

GitHub, GitLab, Bitbucket
  1. 01Invite one named user with Read role on the store repository only, not the organisation.
  2. 02Set an expiry date on the invitation (GitHub and GitLab support this).
  3. 03Prefer not to give repo access? Send a zip of the code without .env files or credentials.
Magento / Adobe Commerce
  1. 01A staging admin user with a restricted role (Stores, Catalog, System > Cache read).
  2. 02Adobe Commerce Cloud: invite as Viewer on the staging environment.
  3. 03No production admin and no SSH to production needed for the audit.
Shopify
  1. 01Approve a collaborator request with only Themes and Apps (view) permissions.
  2. 02Use a duplicate theme for anything that needs testing. Live theme stays untouched.
  3. 03Remove the collaborator from Settings > Users when the audit is delivered.
WooCommerce / WordPress
  1. 01A staging copy is best. Otherwise a user with a limited role, not Administrator.
  2. 02SFTP access to wp-content (read-only if your host allows it).
  3. 03No database export needed; if one is, anonymise customer and order data first.
Paperwork

One agreement, signed in a minute.

Service terms, a mutual NDA and a GDPR data processing agreement in one document. You fill in your company details and sign online before paying; the signed PDF arrives by email straight away.

Book the engineering audit, €290 Read the agreement See a sample report