The software development glossary for the terms at audit. Fifty of them. Plain English.

Information Commissioner’s Office. The UK data protection regulator. The body you report a breach to, and the one that fines you if you handle personal data badly.

Solicitors Regulation Authority. The UK law firm regulator. Legaltech-essential. If you build for solicitors, your software has to fit how the SRA expects client money and case data to be handled.

Institute of Chartered Accountants in England and Wales. The accountancy regulator. It comes up when you build software that touches statutory accounts or audit workflows.

Keeping Children Safe in Education. UK statutory guidance for schools. Edtech-essential. If your product is used by under-18s in a UK school, you build to this from day one.

NHS Clinical Risk Management standard. Required for clinical software in the NHS supply chain. If your software informs a clinical decision, you need a clinical safety case under DCB0129.

Data Security and Protection Toolkit. NHS England’s data security framework. Healthtech-essential. Annual self-assessment that lets you handle NHS data and connect to NHS systems.

UK off-payroll working rules. Determines a contractor’s tax status. HR-tech-essential, and a question funded founders ask before hiring a studio: get IR35 wrong and you inherit a tax problem.

Money Laundering Regulations 2017. The UK’s anti-money-laundering statute. It’s the law behind the AML controls you build into any product that moves money.

Right to Work. The UK Home Office check for an employee’s work eligibility. HR-tech products often have to build the RTW check into onboarding.

Real Time Information. HMRC’s PAYE reporting regime. Payroll software submits an FPS each pay run. HR-tech and payroll products are built around it.

Full Payment Submission. The HMRC payroll report sent on or before each payday under RTI. If you build payroll, the FPS is the submission your engineering has to get right every time.

International information security management standard. Certification-grade. It’s the framework behind a documented information security management system (ISMS). We wire the ISMS for clients who need to certify.

Open Web Application Security Project. The industry-standard web security framework. The OWASP Top 10 is the list of the most common web vulnerabilities, and it’s covered on every audit we run.

Council of Registered Ethical Security Testers. The UK penetration-testing certification standard. When a buyer asks for a CREST-grade pen test, this is what they mean. Empyreal carries a CREST-aligned methodology.

A threat-modelling framework. The letters stand for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. We use it to map the threats to your system before we write the auth.

Consensus Assessments Initiative Questionnaire. The cloud-security procurement questionnaire enterprise buyers send. It’s long. We carry one pre-filled so your sale doesn’t stall on it.

Standardised Information Gathering questionnaire, the lighter version. A procurement security assessment your buyer’s security team sends. Like the CAIQ, we keep one pre-filled.

SOC 2 and ISO 27001 evidence-automation platforms. They watch your systems and collect the audit evidence continuously instead of in a panic the week before. We wire them on day one for clients heading for certification.

Insecure Direct Object Reference. An authorisation flaw where you can read another user’s data just by changing an ID in the URL. Common in vibe-coded apps. It’s one of the first things we test for in a security audit.

PCI DSS Self-Assessment Questionnaire A. The lowest PCI scope you can have. Achievable when card data is handled entirely by a provider like Stripe Elements or Adyen Components. The goal for most checkouts we build.

EU Payment Services Directive 2. It mandates Strong Customer Authentication (SCA) on payments. We build a 3DS2 plus exemption strategy into every checkout so genuine customers aren’t blocked while the rules are still met.

Anti-Money Laundering. Governed in the UK by MLR 2017 and across the EU by 6AMLD. In software it means sanctions screening, PEP screening, a customer due-diligence (CDD) lifecycle, and SAR-ready exports.

Suspicious Activity Report. The AML report filed to the National Crime Agency when a transaction looks suspect. If you build fintech, your software has to make raising and exporting a SAR clean and auditable.

Gross Merchandise Value. The total transaction value running through a marketplace or ecommerce platform. The headline number a marketplace founder lives by, and the one your reporting has to get exactly right.

Black Friday and Cyber Monday. Ecommerce’s biggest traffic peak, often a large slice of the year’s sales in a single weekend. We load-test to 8x baseline before BFCM so the checkout holds when it matters most.

Data Subject Access Request. A right under UK GDPR for a person to ask for all the data you hold on them. The response SLA is 30 days, so we build the export tool into the schema rather than scrambling later.

Standard Contractual Clauses. The EU Commission’s template for legally transferring personal data across borders. Module 2 (controller to processor) is the one we keep on file for cross-border work.

System for Cross-domain Identity Management. The enterprise standard for SSO and automatic user provisioning, so when an admin adds or removes someone in their identity provider, your app keeps up. WorkOS or Auth0 wire it.

Single Sign-On. One login across systems, built on SAML or OIDC. It’s a hard requirement in enterprise procurement, so if you sell B2B you’ll need it. WorkOS or Auth0 wire it.

Recovery Point Objective and Recovery Time Objective. The disaster-recovery maths: how much data you can afford to lose (RPO), and how long you can afford to be down (RTO). The two numbers that size your backups and failover.

IAB Transparency and Consent Framework v2.2. The cookie and consent standard publishers and ad-ops teams need to handle user consent legally across the ad ecosystem.

MongoDB, Express, React, and Node. A full-stack JavaScript combination. It’s been Empyreal’s default stack since 2019, partly because the UK hiring pool for it is deep, so you can always find your next engineer.

Multiversion Concurrency Control. PostgreSQL’s concurrency model. In plain terms, it means a long-running report can read the data without blocking the writes happening at the same time.

Row-Level Security. A PostgreSQL and Supabase feature that pins each row to a tenant, so one customer can never read another’s data even if a query goes wrong. We test it with pgTAP before it ships.

A database anti-pattern: one query returns N rows, then N more queries fire, one per row. It’s the quiet reason a page that was fast at ten users crawls at ten thousand. We catch these at audit.

End of life. The point where a framework or language version stops getting security updates. PHP 7.4 hit EOL in November 2022. CodeIgniter 3 reaches EOL in October 2025. Running past EOL is a security liability.

Service Level Agreement and Service Level Objective. The uptime and response-time commitments you make to customers (SLA) and the internal targets you hold yourself to (SLO). We publish ours rather than hiding them.

An SRE practice: the budget of downtime you’re allowed within your SLO. When you burn through it, deploys pause until reliability recovers. Discipline plus maths, so you ship features without quietly breaking uptime.

Web Content Accessibility Guidelines 2.2, Level AA. The accessibility standard that’s a UK and EU public-sector requirement. We test it with axe plus a manual pass, because automated tools alone miss the things a real user hits.

Software as a Service. Subscription software delivered over the web rather than installed. It’s the model behind most of what we build. Empyreal has shipped 84 SaaS builds since 2019.

Mergers and Acquisitions. When you sell, the acquirer’s CTO walks your codebase on a diligence call. We ship engineering that survives that call: the ADRs, the tests, and the architecture are there to read.

Status Determination Statement. The UK IR35 document that records a contractor’s employment status for tax. HR-tech products often need to generate and store one for each engagement.

Tenancy Deposit Scheme. The UK letting industry’s deposit-protection requirement. Proptech-essential. If you build for lettings, your software has to handle deposit protection within the legal window.