Security

We are a small team, and we say what is actually in place rather than what sounds reassuring. Our Trust Centre lists only controls that are in place today, and we add each one as it goes live.

We take the measures below to protect personal data, as required by Article 32 of the UK GDPR. They are reviewed as the service changes, and we publish the current position in our Trust Centre rather than describing a state we hope to reach.

• Data in transit is encrypted using TLS. Data at rest is encrypted by our hosting and database providers.
• Access to production systems is restricted to the people who need it, protected by multi-factor authentication, and removed when it is no longer needed.
• Administrative access to customer data is limited to what is necessary to operate and support the service.
• Backups are taken by our database provider and restoration is tested.
• Changes to production go through review and automated checks before release.
• Third parties are assessed before they process personal data on our behalf, and are engaged under written terms that meet Article 28.

No service can promise perfect security. If we become aware of a personal data breach we will assess it without undue delay, notify the Information Commissioner’s Office within 72 hours where the breach is notifiable, and tell affected people directly where the breach is likely to result in a high risk to them.

If you believe you have found a security issue, email [email protected] before disclosing it anywhere else. We acknowledge reports within 3 working days, keep you updated, and will not pursue legal action against anyone who reports in good faith under our Responsible Disclosure Policy.

We will investigate without undue delay, notify the Information Commissioner’s Office within 72 hours where the breach is notifiable, notify affected customers where there is a high risk to them, and publish a summary of what happened and what we changed once the immediate risk has passed.