Who owns the code?
The client does. What I build is yours — I manage it for as long as you want me to. If you move elsewhere or carry on yourself, everything goes with you: the code, the data and the environment it runs in.
What if something happens to you?
Delivery includes onboarding a second party, so there's always someone who can take over. On larger projects we bring Nixo Webbuilding on board from the start, so you don't depend on one person.
Where is my data?
Within the EU by default. Exactly what runs where depends on the project and is set out in the proposal. For example: my own sites and Nimad's run on dedicated servers in Nuremberg, with encrypted backups every night to two places outside that server, both in the EU.
And security?
You can set your own requirements and have a party of your choice carry out an independent audit; I supply whatever it needs. On my side I work with automated security scans (OWASP ZAP, Nuclei, Aikido, gitleaks), more than 1,900 tests that have to pass on every change, permissions fetched fresh from the database on every request, rate limits on all login routes, and administration only through a private network.