Trust
Trust Centre
What protects Drentova’s services and the data in them today. Everything listed here is in place now and specific enough to check. We add to this page as each new control goes live, not before.
What we do
Security
Encrypted in transit
In placeEvery page and API is served over HTTPS only. Plain HTTP is redirected, and browsers are told to use HTTPS for the next two years (HSTS).
Firewall in front of every request
In placeAll traffic passes through a web application firewall with DDoS protection before it reaches the application.
Bot checks on sign-in
In placeStaff sign-in, and partner sign-in and password reset, require a bot check that is verified on our server before any credentials are accepted.
Separate staff and partner access
In placeSales partners sign in to their own portal with their own accounts. A partner’s session reaches the partner portal and nothing else: everywhere else it is treated as signed out.
Browser security headers
In placeOnly our own site may frame our pages, browsers are told not to guess file types, and camera, microphone and location access are switched off on every page.
Privacy & data protection
No tracking before consent
In placeAnalytics and advertising code is left out of the pages we send unless a visitor has agreed to it. Without that agreement it never loads, rather than loading and being told to stop.
Data rights requests online
In placeAnyone can ask to see, correct or delete their personal data, or exercise any other UK GDPR right, through the form at drentova.com/legal/data-requests.
Subprocessors
Machine-readable listEvery third party that processes personal data on our behalf, with the safeguard that covers any transfer outside the UK.
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare | Content delivery, firewall, DDoS protection and bot checks | United States | UK Addendum to the EU SCCs |
| Google Cloud | Self-hosted database hosting, for customers who choose to keep their data in the Middle East | Saudi Arabia (Dammam) or Qatar (Doha), as the customer chooses | UK Addendum to the EU SCCs |
| Hostinger | Self-hosted database and application hosting (default location) | India (Mumbai) | UK Addendum to the EU SCCs |
| Oracle Cloud Infrastructure | Self-hosted database hosting, for customers who choose to keep their data in the Middle East | Saudi Arabia (Riyadh) | UK Addendum to the EU SCCs |
| Resend | Transactional email delivery | United States | UK Addendum to the EU SCCs |
| Vercel | Application hosting, content delivery and file storage | United States | UK Addendum to the EU SCCs |
Reporting a vulnerability
If you believe you have found a security issue in any Drentova service, tell us before you tell anyone else and we will work with you.
Email [email protected]. We acknowledge reports and will not pursue anyone who reports in good faith and follows our responsible disclosure policy.
Reviewing us as a supplier? We answer security questionnaires and join review calls; email the same address.