Our platforms handle business records, case information, and customer data. Security, privacy, and reliability are part of how we build rather than something added at the end.
How we think about platform security
Platform security is a design constraint for us rather than a review stage. The controls below are applied across the products we operate, and they are chosen because they hold up under normal operating pressure, not because they look thorough on a page. We track guidance such as the OWASP Top Ten and the NIST Cybersecurity Framework as a baseline.
Access control
Access to production systems is limited to the people who need it to do their job, and is reviewed as roles change. Administrative access requires individual accounts — we do not use shared logins for privileged work. Within our products, permissions are scoped by role so that people see the records relevant to their work and no more.
Data in transit and at rest
Connections to our platforms are encrypted using current TLS standards. Data stored by our platforms sits on managed infrastructure with encryption applied at the storage layer, and backups are held under the same controls as the systems they protect.
Logging and monitoring
Significant actions inside our platforms are recorded, so that account activity and record changes can be reviewed when a question arises. Infrastructure and application health are monitored continuously, with alerting for availability and error conditions.
Infrastructure
We run on established hosting and cloud providers rather than self-managed hardware, which lets us inherit their physical security, network protection, and patching practices. Environments are separated so that development and testing never operate against production data.
Building securely
- Dependencies are kept current and reviewed for known vulnerabilities
- Changes are reviewed before they reach production
- Input handling, authentication, and authorisation are treated as first-class design concerns
- Access to customer data during support is limited and purposeful
Reporting a vulnerability
If you believe you have found a security issue in one of our platforms, we want to hear about it. Please contact us with enough detail to reproduce the issue, and give us a reasonable opportunity to investigate and respond before disclosing it publicly. We will not pursue action against researchers who report issues in good faith and avoid privacy violations or service disruption.
Use our contact form and select “Something else” so your report is routed quickly.
This page describes our current practices. It is not a certification claim, and it may change as our platforms and infrastructure develop.