Back to home

Engineering standard

Every Iron Signal Works project follows a documented engineering standard. This is how we build before you hire us - so architecture, quality, security, and delivery are defined before work begins.

Last updated: September 2026

How we work

Understand → Architect → Build → Harden → Transfer

The fifth step is the point: you keep the system. We are not trying to trap you into paying forever.

01 - Execution & Architecture

Version control

All work is maintained in Git with a clear, reviewable history. Releases are explicit, identifiable, and reproducible. You receive the complete source repository and retain ownership of it.

Environment & configuration

Secrets never belong in the client bundle or source code. Environments are explicit and reproducible. Configuration is validated at runtime rather than assumed to be correct.

Validation & failure handling

External data is validated at the system boundary before it is trusted or used. Failures are observable, logged, and handled deliberately - never silently ignored.

02 - Security, Compliance & AI Governance

Defense in depth

Security is designed into the system rather than added at the end. Access follows least-privilege principles, dependencies are scanned for supply-chain risk, and static analysis helps keep known classes of vulnerability out of production.

AI governance

Where AI is used, models operate behind explicit boundaries. Client and user data is isolated from public model training. Outputs are structured and constrained where the product requires it. The system should refuse when the approved source material does not support an answer, instead of inventing policy. Sensitive fields are masked before they enter an orchestration path. Usage is monitored for reliability and cost.

Privacy & auditability

Privacy is considered at the architectural level, with GDPR / RGPD requirements incorporated where applicable. Sensitive operations are auditable, retention rules are enforced in the system, and activity can be traced to a known request or release.

03 - Quality & Performance

Testing based on risk

Testing is proportional to the consequences of failure. A static marketing page does not require the same test strategy as a financial transaction, authentication system, or critical data pipeline. We test where testing creates real confidence - not artificial coverage numbers.

Accessibility, performance & hardening

Semantic HTML, keyboard access, and coherent interaction patterns are the baseline. Performance budgets are defined and enforced. Transport security, security headers, and other fundamental hardening measures are part of the build - not optional extras.

Deployment & monitoring

Production releases are identifiable and reversible. Deployments are designed to minimise or eliminate downtime. Errors and performance signals remain tied to a known release. When something fails, we should be able to answer what failed, where, and which version introduced it.

04 - Delivery & Sovereignty

Ownership

You own your code, infrastructure, data, and project assets. We do not build systems that deliberately create dependency on Iron Signal Works.

Documentation & handover

Delivery includes the documentation required to understand, operate, and maintain the system. Transfer is not a courtesy. It is the last step of the work: documentation, source, infrastructure access, and enough context for your team to continue. You should be able to continue without us.

Questions about how we deliver: web@ironsignalworks.com

Back to home