Movahedi Solutions
How We Work Securely
1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada. Contact: mohammad@movahedi.ca. This one-page summary describes company practice for working securely. It is a company practice summary, not an employee training deck.
Company practice, in five habits
- Scope first, in writing. No work starts until scope is agreed in writing, with controls and handover stated in the written agreement. Detail: Terms of Engagement.
- Ask only for what the engagement needs. Client material is used only for its engagement, access is limited to what the engagement requires, and material outside scope is raised with the client, not kept silently.
- Keep the public site small and checkable. The public site is a static site built and deployed from GitHub and delivered over HTTPS through Cloudflare. Every publish is checked for errors and broken links before it goes live, and is verified live. Detail: How work is planned, checked, and improved: Preventing known publishing mistakes.
- Close the loop on every issue. A security report is received, reviewed, verified by reproduction, fixed or decided, re-checked, and closed with the reporter told the outcome. Detail: Responsible Disclosure.
- Hand back cleanly. At engagement end, client material is returned or deleted on the client's instruction, and access provided for that engagement is removed as part of closing. Detail: Privacy and Data Handling.
Tools used, only verified tools
Security Stack, as a simple list, not a visual tool grid: Cloudflare for delivery of the public site over HTTPS; GitHub for source and deployment of the public site. No other tool is listed here, because no other tool is verified here as a public-site tool. Engagement tools are agreed per engagement. Detail: Subprocessors.
What We Do Not Do With Client Material
The firm does not store client data on the public website. Instead, engagement data is handled per engagement, under the terms agreed for that engagement, and it is not stored on the public site. The firm does not build a public case study from client work without written permission. Instead, no client work is used publicly unless the client gives written permission. The firm does not sell client data. Instead, client data is used only for its engagement. The firm does not use client data to train models. Instead, client data is used only for its engagement, and removed at engagement end or returned or deleted on client instruction. The firm does not name a client publicly without written permission. Instead, no client is named publicly unless the client gives written permission.
Related pages
Scope and limits, stated briefly
Where a matter is to be confirmed per engagement, it is stated as such, and it is confirmed in writing for that engagement before work starts. Contact: mohammad@movahedi.ca.