Software operations · SOULTWARE LLC
Security questions to ask before building a business application
Security starts with understanding the information the application handles and who should access it. A provider should be able to explain its controls and limitations in terms the business can review.
Classify data and access
List the data types, users, organizations, and actions involved. Identify sensitive, personal, financial, or regulated information and determine which stakeholders must approve its handling.
Ask how authentication, authorization, session management, file access, and account recovery will work. Define what users can see and do, then verify those rules in server-side checks.
Protect environments and credentials
Separate development and production data, limit access by role, and keep secrets out of source code and chat. Decide how credentials are rotated and how access is removed when a team member leaves.
Ask how dependencies are updated, changes are reviewed, and errors are monitored. The answer should describe the actual process rather than relying on a generic claim that the system is secure.
Plan for incidents and recovery
Agree on backups, restore testing, incident contacts, notification expectations, and who can make emergency changes. Decide how the system will behave if an external provider becomes unavailable.
For high-risk applications, arrange review by qualified security professionals. A software development vendor should state the scope of any review and avoid presenting a basic build as a certification.