Security at nerdgeschoss is a handful of habits we all share, written down so nobody has to guess. This page is our official security policy, but really it's just how we work. Jens (CTO) owns the topic, deliberately opposite Christian (CEO), so security always has its own seat at the table.
\nDon't invent passwords. Generate them in the password manager (12 characters minimum, enforced in our systems wherever they allow it, though anything you never type might as well be 40). We don't force password rotation: the BSI agrees that scheduled changes just produce weaker passwords. Change a password when there's an actual reason, like a suspected leak.
\nTurn on multi-factor authentication everywhere. We enforce it wherever technically possible and audit the rest once a year. If a service offers passkeys, use those instead. That's where we're headed anyway.
\nCredentials live in exactly two places: the password manager (one vault per project, access only while you actually work on it) or the encrypted credentials file inside a project. Every environment has its own keys, so a leaked dev key can't open production.
\nSharing happens only through expiring secure links from the password manager, even with customers. Email, chat, and anything else still readable next week are off limits.
\nIf a credential ever lands anywhere else (a Slack message, a screenshot, a commit), it's burned. We rotate it and everything it touches, immediately. Nobody gets blamed for this. When a dev master key once showed up in an internal screenshot, everything was rotated within twelve hours and the customer knew before anyone had to ask. Speak up, rotate, move on.
\nEvery company Mac is managed through Apple Business Manager, so we can centrally verify that disk encryption, the firewall, and security updates are on, and remotely wipe a lost device. macOS ships with always-on malware protection (XProtect, Gatekeeper) that users can't switch off, and MDM lets us verify exactly that. Losing your laptop is a security incident. Tell us right away.
\nBeyond that: full autonomy. You're an adult. Install what you like; all projects run in dev containers, so nothing leaks between projects or into your system. Private use is fine on a separate macOS account. And if you're stuck on sketchy public wifi, use the company VPN.
\nYou get the access your work needs, nothing more. GitHub is organized in per-project teams: maintain by default, admin only for the team lead and CTO. Deployments run automatically from CI. Production is SSH-only through our server tooling, so revoking a key removes access everywhere at once. Day to day, developers don't hold production credentials at all.
\nWhen someone leaves, an offboarding checklist covers every system, and their SSH keys disappear from all servers automatically.
\nNothing reaches main without peer review and QA. Brakeman, bundler-audit and their Node friends run in CI, Dependabot watches our dependencies, and a central inventory of every project's Ruby, Rails and Node versions tells us within minutes which projects a fresh vulnerability affects.
\nCustomer data on our infrastructure lives on German servers at Hetzner. Development happens against anonymized sandbox data: same shape as production, all personal information replaced with random values. Real production data doesn't land on laptops (rare exceptions go through department leads).
\nEncrypted backups go from our servers to separate S3 storage with its own credentials, plus regular offline copies onto a hard drive in a safe place. Even ransomware can't reach a disconnected disk. Restores are tested by hand; automating that is on our list.
\nSomething smells off? A phishing mail, a weird login, a lost device? Tell the CTO immediately, even if the attempt failed. We assess its severity, contain, fix, and learn. Customers affected by an incident hear from us within 24 hours on workdays.
\nEverything one person can access, a second person can too: Christian for devices, the head of backend has root on every server. The founders never take vacation at the same time. And losing a server stays a solvable annoyance: code is in GitHub, infrastructure is reproducible, backups are off-site.
\nOnce a year we walk through this page together in a 30-minute all-hands (which is also how the page itself stays reviewed). New nerds get the same session in their second week. Our apps have been externally pentested without security-relevant findings, and if you find something anyway, tell us. We'll fix it fast and we won't be weird about it.
\nThe short version: we believe in actual security. It happens in what you do every day, and this page just writes it down.
\nLast reviewed: August 2026 ยท Jens (CTO)
","frontmatter":{"title":"Security at nerdgeschoss","shortTitle":"Security","breadcrumbs":[{"title":"Handbook","path":"/handbook"}]},"headings":[{"value":"Passwords","depth":2},{"value":"Credentials","depth":2},{"value":"Your Mac","depth":2},{"value":"Access","depth":2},{"value":"Code and customer data","depth":2},{"value":"Backups","depth":2},{"value":"When something goes wrong","depth":2},{"value":"When Jens gets hit by a bus","depth":2},{"value":"Staying sharp","depth":2}]}},"pageContext":{}}, "staticQueryHashes": ["63159454"]}