Palisadium

What secure means

A project is not “secure” until this is done.

Palisadium works through a written security baseline as a launch gate, not an afterthought. Every item maps to a line in the project record, and a signed copy is retained as the audit trail behind the label.

Briefing
The principle
Hardening is part of development, not a review bolted on at the end. Controls exist before launch because they were written while the code was written. The word “secure” is used only when there is evidence behind it.
01

Applied during the build

Security controls are written as part of the code, not reviewed after it is written. This means they are correct by construction, not patched in at the end.

02

Every item accounted for

Each baseline item is checked, or marked not applicable with a one-line reason. Nothing is silently skipped, and nothing is described as done before it is.

03

Findings remediated, not logged

Critical and high findings are fixed, not recorded in a spreadsheet and left open. The gate closes on closure, not on documentation.

04

Signed before you hear the word

The baseline is signed off internally before the project is told it is launch-ready. Timeline pressure changes the deadline, never the bar.

05

You receive a plain summary

A readable summary of what was done, and what remains your own responsibility. The full technical record stays with us as the audit trail.

06

Evidence retained

For every item checked, the evidence is stored: the test, the result, the date. If someone asks later, there is a record.

Verification standard
OWASP ASVS Level 1, where it applies
For projects with an application surface (login, user data, payment flows), Palisadium builds to OWASP Application Security Verification Standard Level 1 (v5.0.0). A purely static site has no such surface, so it is covered instead by the baseline and a manual review against the OWASP Top 10. Where the standard is claimed, evidence is retained.

What we do not claim

  • That a project is “secure” without a signed baseline behind it
  • Compliance certifications — we prepare evidence, we don’t issue certificates
  • Zero-risk operation — no system is risk-free, and we say so
  • Security work on third-party systems we don’t own or maintain