--- title: 'Trust & security' url: 'https://maw11.preview.mountainairweb.com/trust' markdown: 'https://maw11.preview.mountainairweb.com/trust.md' date: '2026-10-09' --- Trust & security # The answers your *procurement team* will ask for. Security posture, accessibility, contracts, vendor onboarding and support targets, written down so your legal, finance and IT reviews can start before our first call. [ Ask a question ](https://maw11.preview.mountainairweb.com/contact) ### Built to WCAG 2.2 AA Accessibility [Built to WCAG 2.2 AA](https://maw11.preview.mountainairweb.com/trust#accessibility) ### NDA & MSA ready. We sign your paper. Contracts [NDA & MSA ready. We sign your paper.](https://maw11.preview.mountainairweb.com/trust#contracts) ### WP Engine Agency Partner Hosting [WP Engine Agency Partner](https://maw11.preview.mountainairweb.com/trust#hosting) ### US vendor onboarding, handled Compliance [US vendor onboarding, handled](https://maw11.preview.mountainairweb.com/trust#vendor) Security ## How code and access *are handled.* ### Code ownership and review - Theme and integration code lives in a GitHub repository owned by you, transferred at launch at the latest - Every build gets an automated security audit before go-live, with the recommended fixes applied and the report shared with your IT team - Dependencies are pinned and documented; no unvetted third-party code ### Access control - Least-privilege accounts for every environment; admin access only where the work needs it - Multi-factor authentication on hosting, repositories and client admin accounts - Credentials stored in a password manager, shared through yours when you have one, and revoked at handover ### Hosting and patching - WordPress on WP Engine (Agency Partner): managed updates, staging, WAF, daily backups - Virtual patching (Patchstack via WP Umbrella) recommended on every WordPress care plan, so disclosed vulnerabilities are blocked before the vendor fix ships - Flat-file sites on a hardened, Canadian-hosted VPS with git-based deploys and daily off-site backups ### Incidents - Critical issues (site down, suspected compromise) get a response within the care-plan target and work continues until resolved - You are told what happened, what was done and what changes, in writing - Restore tests are run periodically, not just assumed Accessibility ## Built to *WCAG 2.2 AA.* ### In every build - Semantic markup, keyboard navigation, visible focus states, colour contrast checked against AA - Forms with labels, errors and instructions that screen readers announce - Reduced-motion preferences respected ### For your records - An [accessibility statement](https://maw11.preview.mountainairweb.com/accessibility) you can reference in your own policy - Accessibility notes delivered with QA on every project - Audits of existing sites available, with a fix list that doubles as a quote Contracts ## NDA, MSA, SOW. *Your paper or ours.* ### Agreements - NDA and non-solicit signed before any client details are shared - We sign your MSA; SOWs are written to match it so legal doesn’t bounce them - Our own contract templates are available for teams that don’t have paper ready ### Confidentiality - Agency clients are never named, listed or contacted without written consent - Case studies on this site are limited to direct clients and partner agencies - Credentials and data stay inside your systems where possible Vendor onboarding ## A Canadian company, *set up for US clients.* ### Tax and registration - Fully registered Canadian business - W-8BEN-E provided to US clients on request - US IRS filings current; state tax filed in every state we work in ### Onboarding paperwork - Vendor forms, supplier questionnaires and compliance training completed as required - References from marketing leaders at comparable companies available on request - Ask on the call about anything specific your checklist needs Support targets ## Response targets, *in writing.* Set per care agreement to match how the site is used. Business hours, Pacific time; critical issues are monitored continuously. Full detail on the [Care & hosting](https://maw11.preview.mountainairweb.com/services/care-hosting#sla) page. Response targets, \*in writing.\* | Severity | Typical target | |---|---| | Critical | Response within 4 business hours, usually much faster; work continues until resolved | | High | Same or next business day | | Normal | Within 2 to 5 business days | These are the ranges we usually commit to; the exact numbers are written into each agreement. Data and privacy ## Where data lives, *who can see it.* ### Client site data - Stays on your hosting account and in your systems (CRM, forms, analytics) - We do not copy production data to personal devices beyond what a migration or debugging task needs, and we delete it after - Privacy findings discovered during audits are reported to you immediately ### This website - Contact and audit forms email their contents to us and store a copy on our server for follow-up - No advertising trackers; analytics are privacy-respecting - Details in the [privacy policy](https://maw11.preview.mountainairweb.com/privacy-policy) Common questionnaire items ## Quick *answers.* Do you have SOC 2 or ISO 27001? No. We are a small studio, and we work inside your certified platforms (WP Engine, your GitHub, your CRM) rather than holding your data ourselves. We are happy to complete your security questionnaire and show how each control is met in practice. Who else has access to our site? Only the people you approve. For planned absences a named senior developer may be given scoped access for critical issues, with your agreement in advance. Can you work within our VPN, SSO or device policies? Usually yes. We have worked within corporate SSO, OneTrust, Jira and DevOps-managed DNS. Tell us the constraints at scoping. Where is our site hosted and backed up? WordPress: WP Engine data centres in the region you choose, with daily backups plus our off-site copies. Flat-file: a Canadian VPS with daily off-site backups. You can also host on your own infrastructure. ## Ready to move beyond *theme limitations?* We’ll review your current setup and map out a build, migration or AI-visibility plan in a free 30-minute call. [ Start a conversation ](https://maw11.preview.mountainairweb.com/contact) [ Request a free site audit ](https://maw11.preview.mountainairweb.com/free-audit) --- ## Navigation - Previous: [Terms of service](https://maw11.preview.mountainairweb.com/terms.md)