Security

Every record in the database carries the identifier of the organisation it belongs to, and that filter is applied automatically at the data-access layer rather than being left to each query. One customer cannot read another customer's enquiries, contacts or conversations.

All traffic to the application and its API is served over HTTPS. The public domains sit behind Cloudflare, and our own services talk to each other over encrypted connections.

Access to an organisation's data requires an authenticated session belonging to that organisation. Within it, permissions are governed by role profiles that the account's administrators define, so a user only sees the projects and functions their role grants.

Access to production systems is limited to the people who operate the platform.

Public enquiry forms are protected by a Cloudflare anti-bot challenge that fails closed — if the check cannot be completed, the submission is rejected rather than let through. Forms also carry a hidden decoy field to catch automated submissions, and both per-address and per-form rate limits.

Outbound messaging is subject to the acceptable use rules in our Terms of Service. Opt-outs and bounced addresses are suppressed automatically and checked before every send.

The platform runs on managed cloud infrastructure with separate production and staging environments. Credentials and API keys are held as environment secrets, never in the source code, and staging does not read or write production data.

We hold no third-party security certification today — no SOC 2, no ISO 27001. We would rather say so plainly than imply an audit that has not happened. If your procurement process needs specific assurances, write to us and we will tell you exactly what we can and cannot evidence.

If you believe you have found a security issue, please write to [email protected] with enough detail to reproduce it. We will acknowledge your report, keep you updated while we investigate, and we will not pursue action against anyone who reports an issue in good faith and does not access or modify data belonging to other people while doing so.

Please give us a reasonable window to fix it before disclosing it publicly.