Security and data handling
Automation reaches into customer records, calendars and payment systems. That access is the point of it, and it is also the exposure. Below is what I do about that, and what I have no business claiming.
01 This website
- No JavaScript
- This site runs none at all. No tracker, no analytics, no chat widget. Nothing executes in your browser, so there is nothing here for anyone to hijack.
- No third parties
- Every byte comes from this domain. No fonts, scripts or images pulled from anywhere else, so nobody else learns you were here.
- No cookies
- None are set. That is why you were not asked to dismiss a banner.
- Locked down at the header
- A strict content security policy, HSTS, and frame, referrer and MIME protections, all set at the server. The policy forbids scripts outright, so there is no allowlist to get wrong.
02 What I do on a build
- Least privilege
- An integration gets the narrowest API scope that does the job. Something that only needs to create appointments never gets permission to read your customer list.
- Your accounts stay yours
- Credentials live in your accounts. I hold no standing access to your banking, payouts or payment processor, and I will turn it down if you offer.
- Secrets are not in code
- Keys and tokens live in environment configuration. Never in source, never in a repository, never in an email or a chat message.
- Read before shipped
- Every line touching money, authentication or personal data gets read by a human before it goes live, including anything a model wrote. The failures that matter here do not crash anything. They run correctly and leak.
- Releases are gated on a live run
- A passing test suite gets a release to the starting line. The gate is driving the real system against real input and watching what happens.
- Keep less, for less time
- Systems store the minimum the job needs and purge on a schedule. Contact details are stripped out of public logs before anything is written.
- One business cannot see another
- Where one system serves several businesses, "can business A see business B's data" is a question with a test written against it.
03 What I do not claim
I am one person. No SOC 2 audit, no ISO 27001, and I am nobody's HIPAA business associate. If a vendor my size tells you otherwise, ask them to send you the report.
If a build would touch protected health information, card data, or anything else with a compliance regime attached, say so on the first call. Some of that work can be scoped properly with the right agreements in place. Some of it I should turn down, and the time to establish which is before you have paid me.
Found a hole in one of my systems? Email paul@millikenautomation.com with what you did and what happened. I will confirm I got it, and nobody acting in good faith has anything to worry about from me.