We made our security design choices before we had a customer
Corrected 27 September 2026: the statements below on cryptography and encryption now say exactly what production runs; so do the ones on isolation and the network.
Security posture in a young software company usually arrives in a particular order. First the product, then the customers, then the enterprise buyer who sends a 300-question spreadsheet, then the engineer whose job for the next two quarters is to make the answers true. Logging gets extended to cover what the framework asks for, and a supply-chain story is assembled from whatever the build pipeline happened to do.