Built carefully. Run responsibly.

This page describes how Veda Software builds and operates software: the engineering standards applied on every engagement, how delivery is protected, who is accountable, and what happens after launch. It is written for the people who evaluate suppliers — procurement teams, IT leads and public-sector buyers — and it states only what we actually do.

1. 01

   Architecture before implementation

   Every system starts with recorded design decisions — data model, integrations, security posture and technology choices, each with a commercial reason attached. Structure is agreed before build cost is incurred.

2. 02

   Code review as standard

   No code reaches production unreviewed. A senior engineer reads, questions and approves every release — modern engineering with human quality control.

3. 03

   QA and testing as deliverables

   Testing is scoped, performed and evidenced as part of the work: functional checks, edge cases, performance and security. It is a line in the plan, not an afterthought squeezed against a deadline.

4. 04

   Documentation shipped with the system

   Every system is handed over with documentation — what it does, how it is structured, how to run it and how to change it. Knowledge is not allowed to live only in our heads.

5. 05

   Version control and environment separation

   All work happens under version control, with separate development, testing and production environments. Changes are traceable, reviewable and reversible.

6. 06

   Dependency and update discipline

   Third-party dependencies are chosen deliberately, kept current and reviewed for known vulnerabilities. Ageing dependencies are a security risk, so updates are routine work, not exceptional events.

1. 01

   Access control and least privilege

   People and systems get the minimum access needed to do their job, for the shortest time it is needed. Access is reviewed during engagements and removed when they end.

2. 02

   Secrets handling

   Credentials, keys and tokens are never hardcoded, shared over email or committed to repositories. They live in managed secret stores, scoped per environment.

3. 03

   Data protection by design

   Systems are designed around UK GDPR principles from the first architecture decision: data minimisation, purpose limitation, and clarity about where personal data lives and why it is held.

4. 04

   Secure defaults

   New systems ship locked down — encrypted in transit, authenticated by default, with public exposure a deliberate decision rather than an accident of configuration.

5. 05

   Incident honesty

   If something goes wrong, you hear it from us first: what happened, what it affects, what we are doing about it, and what will change so it does not repeat.

1. 01

   Senior technical oversight on every engagement

   Every project has a senior engineer accountable for its technical decisions — not just its delivery date.

2. 02

   Named accountability

   You know who is responsible for your system, by name. Accountability is never diffused across a department.

3. 03

   Clear escalation paths

   If something is not right, there is a defined route to the person who can fix it — agreed at the start, not improvised under pressure.

4. 04

   NDA-friendly

   We routinely work under non-disclosure agreements, and treat client information as confidential by default — agreement or not.

5. 05

   Supplier-assessment friendly

   We complete security questionnaires and due-diligence processes as part of procurement, and answer them factually.