AKADATA LIMITED
Engineering and Operating Principles
How Akadata Limited works: source and dependency control, documentation, access management, testing, change approval and rollback, security reporting, and support boundaries.
Engineering and operating principles
This page sets out how Akadata Limited builds and operates systems: what we supply, what the customer receives, what is excluded, and how each statement can be checked. Results are measured against the agreed acceptance criteria.
Every engagement starts with a written scope. The practices below apply to all delivery work unless the contract records an agreed exception.
Working practices
Each practice below states what Akadata supplies, what the customer receives, and what is excluded. Where a statement can be inspected or measured, the evidence is named.
Source and dependency control
Akadata supplies application and infrastructure code in a Git repository. Dependencies are pinned to explicit versions in a lock file, and installs are verified against recorded checksums.
The customer receives the repository, its commit history, the lock files, and a list of third-party licences. This can be inspected in the commit log, the lock file, and the dependency audit output.
Documentation requirements
Each engagement is delivered with a written scope, an architecture note, a runbook covering start, stop, backup, and restore, and a handover pack. Decisions are recorded with the reason and the date they were made.
Documentation is written in Markdown and stored in the same repository as the code, so it is versioned alongside it. Training courses and printed manuals are not included unless separately scoped.
Access management
Repository access requires multi-factor authentication. Accounts belong to named individuals rather than shared logins, and access is granted per repository and per environment.
Credentials are held in an encrypted store and transferred to the customer at handover, after which Akadata accounts are removed on request. Data residency, minimisation, and credential handling are recorded in the UK GDPR documentation supplied with the engagement, and the access list for each repository and environment is available for inspection.
Complete our Data Protection Impact Assessment template to record lawful basis, processing risks, and mitigations for a project.
HTML and plain-text copies are available for your own governance files.
Testing requirements
Automated tests run on each change: unit tests for application logic, integration tests against a test database, and route checks confirming that each public URL returns its expected status code and content.
Acceptance criteria are agreed in writing before build starts, and each criterion is checked at handover. The customer receives the test suite and the CI configuration. Penetration testing and load testing are scoped and priced separately.
Change approval and rollback
Changes to a live system are proposed in writing with the intended effect, the rollback step, and the expected downtime. Work starts once the customer has approved that proposal.
Every change is recorded in a version-controlled change log with the date, the author, and the commit reference, and releases are tagged so an earlier tag can be redeployed. The change log and the release tags are available for inspection.
Security reporting
Security issues in anything we host or maintain can be reported to contact@akadata.ltd. Reports are acknowledged in writing, and the assessment, the decision, and any fix are recorded in the change log for the affected system.
Where a reported issue affects software we did not write, we pass it to the maintainer and tell the customer what was sent and when. We do not publish customer names or system details in advisories.
Support boundaries
Support after handover is a separate agreement. Retainers start at £450 + VAT per month and cover up to 8 hours of monitoring, patching, and scheduled work. Day-rate work is £450 to £1,200 + VAT per day depending on scope and risk.
Hours beyond the retainer are agreed in advance and in writing. A support agreement is not required to keep a delivered system running: the documentation and credentials handed over allow the customer, or another supplier, to operate it.
Application security controls
Application security relies on contextual output encoding, parameterised SQL queries, a content security policy, locked and checksum-verified dependencies, and automated tests.
Where authentication is required, integrations use JWT-based authentication and credentials are handled through an encrypted store. The response headers, the query code, the lock file, and the test suite can each be inspected directly.
We All Breathe the Same Breath
"Some say we bleed the same blood. We say we all breathe the same breath."
This is the company motto, and in practice it sets the working standard: engagements are scoped in writing, priced against that scope, and closed with a handover pack.
A delivered system is documented so that the customer, or another supplier, can operate it without Akadata.