The standard holds
from the first decision
to the running system.
Six standards govern the architecture, delivery and continuing operation of every Seichō system.
- Security
- Designed in from the first decision
- Migration
- Assisted, from the first record to the last
- Hosting
- EU by default
- Testing
- Independent penetration testing scoped where a system holds sensitive or regulated data
Security is designed in from the first decision.
Security is settled in the architecture before any code is written: where data is stored, who can reach it and how it leaves the system.
Development follows recognised secure-coding practice, including the OWASP guidance. Where a system holds sensitive or regulated data, independent penetration testing is scoped into the proposal before go-live.
- What the client receives
- The agreed security requirements and, where scoped, the independent test report.
Every migration is assisted, from the first record to the last.
Seichō plans and carries out the move from the old system to the new. Records are mapped, checked and moved in rehearsed stages, and both systems run in parallel on real data until the results agree.
The firm stays through cutover until the business runs on the new system unaided. Only then is the old system switched off, and the business receives the runbook, a one-page record of every workflow and the rollback procedure.
Access follows the role, and nothing more.
Each person sees only what their role requires. Administrative tools sit behind a separate sign-in that the public internet cannot reach.
Credentials are held in a secure store, never in code, and data is hosted in the EU by default.
- What the client receives
- The role and permission record.
No change reaches the business unreviewed.
Every change is reviewed separately from its authoring, by automated analysis and a senior reviewer, and passes automated tests before release. Once it ships, it is confirmed on the live system rather than assumed from a successful build.
Software is kept on supported versions, with no known critical vulnerability left open.
- What the client receives
- The review and test record and the post-release check.
Consequential actions wait for a named person.
Anything that moves money, contacts a client or changes a record of consequence is held until a named person approves it. The system proposes; a person decides.
Every action is recorded: who acted, when, on what input, who approved it and any edits they made.
- What the client receives
- The action record.
Every release has a tested way back.
Each system has a kill switch that stops it at once, and a reversal that has been rehearsed, not merely written down.
Backups are taken automatically and restored in testing, so recovery is proven before it is ever needed.
- What the client receives
- The rollback procedure and restore test record.
Data handling follows the agreed terms.
EU hosting, credentials in a secure store and access by role govern the handling of client data.
Confidential material is shared only once terms are agreed.
The website privacy notice sets out how website data is handled.