Engineering standard
Every Iron Signal Works project follows a documented engineering standard. This is how we build before you hire us - so architecture, quality, security, and delivery are defined before work begins.
Last updated: September 2026
How we work
Understand → Architect → Build → Harden → Transfer
The fifth step is the point: you keep the system. We are not trying to trap you into paying forever.
01 - Execution & Architecture
Version control
All work is maintained in Git with a clear, reviewable history. Releases are explicit, identifiable, and reproducible. You receive the complete source repository and retain ownership of it.
Environment & configuration
Secrets never belong in the client bundle or source code. Environments are explicit and reproducible. Configuration is validated at runtime rather than assumed to be correct.
Validation & failure handling
External data is validated at the system boundary before it is trusted or used. Failures are observable, logged, and handled deliberately - never silently ignored.
02 - Security, Compliance & AI Governance
Defense in depth
Security is designed into the system rather than added at the end. Access follows least-privilege principles, dependencies are scanned for supply-chain risk, and static analysis helps keep known classes of vulnerability out of production.
AI governance
Where AI is used, models operate behind explicit boundaries. Client and user data is isolated from public model training. Outputs are structured and constrained where the product requires it. The system should refuse when the approved source material does not support an answer, instead of inventing policy. Sensitive fields are masked before they enter an orchestration path. Usage is monitored for reliability and cost.
Privacy & auditability
Privacy is considered at the architectural level, with GDPR / RGPD requirements incorporated where applicable. Sensitive operations are auditable, retention rules are enforced in the system, and activity can be traced to a known request or release.
03 - Quality & Performance
Testing based on risk
Testing is proportional to the consequences of failure. A static marketing page does not require the same test strategy as a financial transaction, authentication system, or critical data pipeline. We test where testing creates real confidence - not artificial coverage numbers.
Accessibility, performance & hardening
Semantic HTML, keyboard access, and coherent interaction patterns are the baseline. Performance budgets are defined and enforced. Transport security, security headers, and other fundamental hardening measures are part of the build - not optional extras.
Deployment & monitoring
Production releases are identifiable and reversible. Deployments are designed to minimise or eliminate downtime. Errors and performance signals remain tied to a known release. When something fails, we should be able to answer what failed, where, and which version introduced it.
04 - Delivery & Sovereignty
Ownership
You own your code, infrastructure, data, and project assets. We do not build systems that deliberately create dependency on Iron Signal Works.
Documentation & handover
Delivery includes the documentation required to understand, operate, and maintain the system. Transfer is not a courtesy. It is the last step of the work: documentation, source, infrastructure access, and enough context for your team to continue. You should be able to continue without us.
Questions about how we deliver: web@ironsignalworks.com
Back to home