Security from day one: how we build software
At wunderwerk, security is not an add-on. It is our standard in concept, development and operation.
- 80+ projects
- Software in operation for 10+ years
- 5.0 on Google
- EU & GDPR first
- For apps, customer portals, SaaS and custom software – security comes as standard
What does security by design mean?
Security by design means that security is planned in while software is being designed, not retrofitted after go-live. Who may see what? Which data is really needed? How is each version checked, and who installs the updates later? wunderwerk answers these questions in the concept, before the first line of code is written.
That is safer and often cheaper too: a vulnerability that never arises does not have to be hunted down and fixed under time pressure.
| Security as an afterthought | Security by design at wunderwerk | |
|---|---|---|
| When | after go-live, often only after an incident | in the concept, before anything is built |
| Access | permissions added later, often with gaps | roles and permissions from the start, tailored to your users |
| Data | whatever comes up gets stored | only what is needed, hosted in the EU |
| Checks | once, if at all | before release: code review, automated tests, AI-assisted security tests |
| Operation | updates pile up | updates, backups and monitoring as a fixed part of maintenance |
Six principles for your project
App, customer portal, SaaS or internal software: at wunderwerk these principles are standard. How far each one goes is something we decide together in the concept, to suit your data and your budget.
How does wunderwerk build secure software?
wunderwerk builds secure software in four steps, each with a fixed security task: the concept defines roles, permissions and data flows; development follows secure coding practice; releases are checked first; and in operation, updates, backups and monitoring keep the software current. In the trade this is called DevSecOps: security as part of the daily work rather than a final sign-off.
- 1
Concept: know the risks before they become code
In the workshop we go through which data is involved, who needs access and which interfaces face the outside world. The result is a roles and permissions concept and clear decisions on hosting and data protection, before anything is built.
- 2
Development: built securely, step by step
We code to proven rules for secure software, rely on well-maintained, widely used building blocks and keep credentials separate from the code. We develop and test new features separately from the live system.
- 3
Checks: before release
We check new versions before release: with code review by a second developer, automated tests of the key workflows and AI-assisted security tests that look for the typical vulnerabilities of the OWASP Top 10. Anything that turns up, we fix before release.
- 4
Operation: staying current, year after year
After go-live we look after your software if you wish: security updates, backups, monitoring and a direct line when something comes up. We have worked with many clients this way for more than ten years.
Software ages. Security is upkeep.
Even well-built software becomes vulnerable over time: new security flaws are constantly discovered in the building blocks applications rely on. So software needs someone who knows it and maintains it regularly.
That is why our work does not end at go-live. wunderwerk looks after software that has been running and evolving for more than ten years, for some clients for 10 to 15 years, for Egger since 2010. That is software built to last.
- Security updates as part of maintenance
As part of maintenance, we install and test updates to building blocks and servers regularly instead of leaving them for years.
- Acting when a vulnerability becomes known
If we look after your software, we check whether you are affected when a critical vulnerability in a building block it uses becomes public, and take care of the update.
- Backups and monitoring
Regular backups so your data can be restored after an error or incident, and monitoring that flags anything unusual.
- Hosting in the EU
In EU data centres, or in your own infrastructure if you prefer.
- A direct line, not a ticket system
When something comes up, you talk to the small development team that knows your software, and to the managing director.
Your software wasn’t built by us? We check it too.
Many companies run an application built by another agency, a former employee or an AI tool, and do not know how secure it is. For them, wunderwerk offers a security check: an outside-in first assessment, AI-assisted and automated, that checks for the more obvious vulnerabilities. In a free initial consultation we clarify which application is to be checked and what you want to know. You then receive a quote with a clear scope and cost estimate before we check anything.
The security check is a first assessment, not a certified penetration test and no guarantee that an application is secure afterwards. It shows where you stand and what to do first. More: AI-assisted penetration testing for web apps.
Thank you very much!
I will get back to you.
If it’s urgent, book an appointment in my calendar right away: Book an initial consultation
Not just clients. Partners.
We focus on long-term partnerships. You stay flexible thanks to open standards and clear documentation.
What our clients say:
A selection of our client feedback.
★★★★★Many thanks for building and looking after our online learning platform.
We can wholeheartedly recommend Christoph and his entire team.
Whatever we ask for, almost everything is made possible, and the ongoing personal contact works brilliantly too. Many thanks.
We run the online shop thecurtain.shop for made-to-measure curtains and Roman blinds.
Working with wunderwerk was excellent in every respect.
Thanks to their work, we can offer our customers an intuitive, professional shopping experience that perfectly reflects our craftsmanship. Many thanks for the great collaboration!
Very likeable wunderworkers! Fast, uncomplicated, competent and always ready to save the world!
Highly competent support. Well advised all round.
Chris knows how to solve a problem. Quality has a name: wunderwerk.io
We had the wunderworkers develop bespoke industrial software for creating recipes for a highly sensitive industrial process.
The collaboration was extremely professional from the outset: the team quickly understood our complex requirements, implemented them precisely and always paid close attention to maximum reliability and security. I would particularly like to highlight their technical know-how, clean documentation and fast response times for questions or change requests.
The recipe editor is now running in several plants in Sweden, Italy and the Czech Republic.
The software runs reliably, is intuitive to use and our customers are completely satisfied. We can recommend wunderwerk without reservation!
wunderwerk built a digital solution for my photography business that has been running stably and reliably for years. The support is top-notch, reliable and competent. I can only recommend them.
Christoph Niedermoser and his team impressed us with their professionalism, precision and reliability, both in the consulting phase and in the implementation that followed.
Our requirements were implemented perfectly, and the GPS tracking system has now been in successful use in several of our facilities for a number of years.
Chris and his team gave me superb advice on my app idea. Uncomplicated, fast and professional! Highly recommended!
We have already implemented and completed several projects together over the past few years.
Professional implementation and personal contact.
Highly recommended!
Perfect implementation of our
billiards platform.
A very pleasant collaboration. It was fun! Highly recommended!
Why us?
What else is on your mind?
Many projects touch more than one topic. Here are the other areas in which we support businesses.
Secure software starts with the first conversation.
In a free initial consultation we work out with you what matters for the security of your project. Already running an application? Then we will also discuss what a security check for it would look like.
Frequently asked questions about secure software development
Question not listed? We will answer it directly with the managing director in the free initial consultation.
What does security by design mean?
Security by design means that security is part of a software’s design from the outset rather than retrofitted after go-live. The concept already defines who may access which data, which data is stored at all, how new versions are checked and who keeps the software up to date in operation. wunderwerk builds software on this principle, from apps to customer portals.
How secure is an app you develop?
No software is absolutely secure, and anyone who promises that should make you sceptical. What we can describe is the way wunderwerk builds apps: roles and permissions from the start, secure coding, checks before release with code review, automated tests and AI-assisted security tests, encrypted data transfer, EU hosting and ongoing updates in operation. If you want a secure app built, ask exactly these questions, of us and of any other provider.
Where is our data stored?
The data of applications that wunderwerk develops and runs is stored in EU data centres. If you prefer, we also run the software in your own infrastructure. Data is encrypted in transit, and sensitive data is also encrypted at rest where needed.
Who takes care of security updates?
Security updates are handled by the wunderwerk team, as part of maintenance after go-live. We install and test updates to building blocks and servers regularly, and when a critical vulnerability in a building block we use becomes public, we check whether your software is affected. Software ages even when nobody changes it. That is why updates, backups and monitoring are part of operation for us, as with clients we have looked after for more than ten years.
Can you also check our existing software?
Yes, wunderwerk also checks software built by others, with a security check. In a free initial consultation we clarify which application is to be checked and what you want to know; you then receive a quote with a clear scope and cost estimate. We only check with your written authorisation, from the outside, AI-assisted and automated, carefully and in agreement with you. Afterwards we talk you through what we found and what to do first. The security check is a first assessment, not a certified penetration test and no guarantee that the application is secure afterwards. Then you decide: fix it yourself, have us secure and look after the software, or commission a penetration test from a specialist. We can point you to specialist providers.
What does privacy by design mean?
Privacy by design (data protection by design) means planning software so that it processes only the personal data it really needs and protects that data from the start. That is why wunderwerk decides in the concept which data is needed, who may see it and when it is deleted again.
What is DevSecOps, and do you work that way?
DevSecOps describes a way of working in which development, security and operations belong together, instead of security being signed off once at the end. That is exactly how wunderwerk works: the same small development team plans, builds, checks before release and looks after the software in operation. We check new versions before release with code review, automated tests and AI-assisted security tests.
What is the OWASP Top 10?
The OWASP Top 10 is a globally recognised list of the ten most common security risks in web applications, published by the non-profit OWASP Foundation. It includes, for example, broken access control, insecure logins and outdated components. wunderwerk uses the OWASP Top 10 as a checklist when coding and in the security tests before release.
Do you use AI for coding, and is that secure?
Yes, wunderwerk uses AI in development, including our own AI agents, the wunderbots. It is secure because AI-generated code follows the same rules as any other code: a developer reviews it, it is tested, and it is checked for vulnerabilities before release. AI makes us faster; responsibility for the code stays with the team.
Does security cost extra at wunderwerk?
At wunderwerk, the principles on this page are not an add-on package; they are built into the cost estimate you receive before each step. Roles and permissions, secure coding and checks before release are part of our standard. Ongoing services after go-live, such as hosting, maintenance and updates, are agreed separately so you know what operation costs. A security check for existing software is a separate service: after the free initial consultation you receive a quote with scope and cost estimate. For a first estimate, use the form or book an initial consultation.