Security
Security you can check.
We look after websites, enquiries and access to business accounts, so here is exactly how we protect them. Every point describes how this website and our client portal are actually built.
Secure connections onlyCyber insured with HiscoxPortal staff use two step sign in
This website
Built to keep visitors and enquiries safe.
These protections are sent with every page. Your browser enforces them, so they work whether or not anyone is watching.
- Secure connections only. Browsers are told to load this site over an encrypted connection only and to remember that for a year.
- Only code we approve can run. A strict content security policy means the only scripts that can run are our own, two Cloudflare services (the bot check on our forms and our visitor statistics) and Google Analytics, which loads only if you allow it.
- No other site can frame ours. Pages refuse to load inside another website, which blocks a common trick for capturing clicks.
- No advertising code. No ad networks or advertising cookies. Analytics cookies are set only if you allow them and our fonts are hosted on our own site.
- Every form is checked. Cloudflare Turnstile checks you are a person. A form can only reach our systems with a secret key that never appears in the page.
- Every version kept. Each version of the site we publish is kept, so an earlier one can be restored at any time.
- Secret keys locked away. They are never kept in our website or portal code.
Our client portal
Your enquiries and reports, kept to you.
The portal holds your website enquiries, reports and documents. This is how it keeps them private.
- No passwords. You sign in with a single use code sent to your email, which expires after 15 minutes.
- Two step sign in. An authenticator app can be added to any account. It is always on for our staff.
- Each business sees only its own information. The database itself enforces this, not just the screens.
- Files open through private links. Each link works for two minutes, so a forwarded link soon stops working.
- Automatic sign out. After two hours without activity.
- Photos lose their location. When you send job photos, camera and location details are removed on your phone before anything leaves it.
- No third party code. The portal is written in plain JavaScript and sends the same kind of strict security headers as this website.
If something goes wrong.
No business can promise nothing will ever happen. What we can promise is how we will respond and that we are insured for it.
- Registered with the ICO. Our registration reference is ZB861099. You can check it on the ICO’s public register.
- We tell you without undue delay if an incident affects information we handle for you, as UK data protection law requires.
- We report it to the ICO within 72 hours where the law says a breach must be reported.
- We can roll back. Every published version of this website and our portal is kept, so an earlier one can be restored.
Found a security problem? Email [email protected] and we’ll reply within one working day. Our contact details are also published in the standard security.txt file.
We’re insured.
Our cover is with Hiscox, arranged through PolicyBee. Clients can ask for a copy of our certificate.
- Cyber and data insuranceCovers the costs of a cyber or data incident: investigating it, notifying the people affected and the regulator, restoring data, plus claims or investigations about personal data.
- Professional indemnity insuranceCovers compensation to clients if there is a problem with our work, along with the legal costs of defending a claim.
- Public liability insuranceCovers accidental injury or damage to property caused by our business, for example when we visit you.
Where does your data go?
See where your information is stored, every service that handles it, what each one sees and how long we keep it.