Security Questions Before You Sign
Security questions belong in the same week as the quote, not after the first production key leaks into Slack. You are hiring a team that will see your repo, your store, and maybe your users. At Croncode we expect to answer these. We also ask them of you. This is not a pentest report. It is the minimum paper. Handover later uses the same list: handover.
Before you sign, ask where secrets live, who holds Apple roles, what data classes exist, and how access ends. A vibe and an NDA are not a security review.
What should you ask about accounts?
- Who is Apple Account Holder? Ownership.
- Where do signing certificates and push keys live?
- Which company emails have Git and host admin?
- What is the offboarding step when a person leaves?
Istanbul diligence includes entity and overlap: hiring checklist. References: check references. We are Croncode LLC in Albuquerque, not croncodetech.com. Identity.
What should you ask about data?
| Class | Ask | Related |
|---|---|---|
| Photos, journals, bookings | Where stored, who can export | Deletion |
| Analytics IDs | Which SDK, why | Analytics |
| Model prompts | Logged or not | Fail-safe AI |
| Staff tools | Same binary or not | Shared codebase |
Creep line: personalization. Brief: AI brief.
When is an NDA enough?
Never as the only control. An NDA does not rotate a key. It does not remove a personal Apple Admin. Put access and deletion clocks in the statement of work. Commercial shape: fixed price vs retainer. Quote packet: what to send.
People who will be on paper: Goktug Unver, Yusufhan Sokur, Ozgur Ismet Ozkan. Do not invent extra staff. Roster: meet the team.
How do consumer apps change the questions?
Ask whether the studio’s own apps follow the same rules. Ours are separate listings: YourStyle, Numira, Spylie, Luviport. We do not share a client user graph with them. Catalog: what Croncode builds. What we refuse: will not build.
What answers should make you walk?
- “We use a shared Apple ID on Slack”: walk.
- “Production dump in the ticket”: walk.
- “The intern has Admin everywhere”: walk.
- “We will add deletion after launch”: walk if you have accounts.
Choose a studio: choose an iOS studio. Models: studio vs freelancer. Hire: hire. Custom: custom software. Contact: contact. Journal: /en/journel/. Shipping: how we ship.
What should a kickoff demo prove about security?
A staging build, no production secrets on screen, and a named vault. Sprint demo: sprint demo. Support mailbox on a company domain: support. Site host access is a separate list: cPanel.
We will not claim we are “bank grade” as a slogan. We will write where keys live. Paywalls and privacy labels are part of this week, not decoration: honest paywalls. Ask how backups are encrypted and who can restore them. Ask whether staging uses a copy of production users. If the answer is “we use the live database to test,” stop. A small consumer app can still leak a closet photo or a decision journal. Size is not a shield. Write the restore test as a rehearsal, the same way you rehearse deletion.
Ask who can export a user. Ask whether that export is logged. A small app still needs a name on that action. If the answer is “anyone with the admin site,” tighten it before you collect the first closet photo or the first decision journal. Access is a product decision, not a later IT ticket. Write that owner name in the SOW.
Frequently asked questions
Do I need a security questionnaire PDF?
A short written list is enough for a small consumer app. A long PDF helps if you already have compliance staff. Empty forms waste both sides.
Can the studio use personal laptops?
Ask about disk encryption, lock screens, and whether production keys sit in chat. The laptop brand is not the question.
Will you sign our vendor security addendum?
We can review a reasonable addendum. We will not sign fiction about a 200-person SOC team we do not have.
What about payment card data?
Prefer Apple and established processors. Do not ask a small studio to store PAN. Ecommerce: revenue.
Who answers these at Croncode?
The founder on the contract, usually Goktug Unver, with engineering named in the SOW.
