Ready is a standard, not a date.
Before any Sarv Systems product reaches a customer, it clears a written bar covering security, reliability, data handling and how we support it.
The bar is the same for every product, whatever it’s built with. Each product proves it with evidence, and is checked again before every major release.
The bar
What every product has to show before a customer sees it, in the order we check it.
Security
Secrets never live in code or images, and stored credentials are encrypted with the key held apart from the data. Access control is tested on every route, and dependencies and images are scanned on every change.
Reliability
Products recover from failures on their own, and backups are kept away from the systems they protect. Restores are rehearsed on real hardware, not assumed.
Observability
When something breaks, a person is told. Work that should happen regularly records when it last succeeded, so nothing fails silently. Logs never carry secrets or customer data.
Release
Releases are built by automation, versioned and signed, and every upgrade is tested to keep customer data intact. There’s always a written, rehearsed way back.
Infrastructure
Hosting is declared as code. Every role and permission is the least the job needs. Read-only access is proven unable to write.
Data and privacy
Every kind of data a product holds is listed with where it lives and why. Every outbound connection is declared, and checked by watching real traffic, not just by reading code.
Quality
Figures customers act on are reconciled against their source of truth on real data. Integrations are tested against the real services, not stand-ins.
Legal and business
Privacy terms match what the product actually does. Customers know which third parties touch their data.
Support and operations
Customers know how to reach us and what response to expect. Each likely failure has a written runbook, and incidents follow a set process.
Documentation
Install, upgrade and operations guides ship with every release, and someone who didn’t build the product installs it from the guides alone.
How it’s checked
- 01
Every check has a pass condition and needs evidence. “We believe so” doesn’t pass.
- 02
Some checks block a launch. They’re met, or the exception is written down with an owner and a date to close it.
- 03
The bar rises with the stage. A pilot clears a strict subset. General availability clears all of it.
- 04
It’s run again before every major release, at least once a year, and whenever the way a product is hosted changes.
It gets stricter
When a product teaches us something the hard way, through an incident, a test finding or a customer’s security review, we ask whether another product would have hit it too. If so, it becomes part of the bar for all of them. Checks are added, never quietly removed.
Ask us about the bar, or get our registration details for due diligence.
THE BAR APPLIES TO EVERY SARV SYSTEMS PRODUCT.
PRODUCTS PUBLISH THEIR OWN SECURITY NOTES.