Security and data
How we look after your data.
Plain answers for owners, with enough detail for whoever checks it for you.
In the software we build.
Least access
People and systems get only the access they need, and each customer login sees only its own records.
Encrypted in transit
Everything is served over HTTPS, and data moves between systems over TLS.
Secrets kept out of sight
API keys and passwords live in the hosting provider's encrypted settings, never in code, spreadsheets or email.
Reviewed and tested
Changes are reviewed and tested before they go live, with automated checks on every update.
Kept up to date
With managed hosting, we apply security updates to the software and the libraries it depends on.
Backed up
With managed hosting, your data is backed up, so it can be restored if something goes wrong.
Your data, your rules.
What changes when we build or run software that holds your customers' details.
You stay in control
When software we build or run holds your customers' data, you are the controller and we are the processor, under a data processing agreement in the contract.
Hosting region agreed with you
We choose hosting regions with you, and default to the UK or EEA wherever the service allows.
Always exportable
Your data can be exported whenever you ask, and a full handover moves everything into your name.
On this website.
We hold ourselves to the same standard. The privacy policy has the full detail.
No third-party scripts
This site loads no trackers, third-party fonts or embedded media, which removes a whole class of data leaks.
Minimal data
Forms ask only for what we need to reply, and analytics stay off. The privacy policy lists every field.
Multi-factor access
The accounts that hold enquiry data are protected by multi-factor authentication.
Questions about security.
Do you sign a data processing agreement?
Yes. Where we build or run software that holds personal data on your behalf, the contract includes one, setting out what we may do with the data and how it is protected.
Who can access our data?
Only the people working on your project, and only for as long as they need to. Access is removed when it is no longer needed.
What happens if something goes wrong?
If we find or suspect a breach affecting your data, we tell you without undue delay, so you can meet your own reporting duties.
Can we review your security measures?
Yes. The measures on this page are set out in a security schedule in our client contracts, and we are happy to answer a questionnaire.