Trust
Security
Last updated
How we protect the data you entrust to us, and — just as usefully — what we have not yet put in place. Everything on this page is something we can evidence.
Our approach
We are an early-stage company and we would rather tell you exactly where we are than imply a maturity we have not reached. This page describes the controls that are in place today. Where something is not yet in place, it says so.
If you are evaluating us and need something specific — a questionnaire answered, a control evidenced, a contractual commitment — ask. We will tell you what we can and cannot do.
Infrastructure
Our website and application services run on Vercel. Our data is held in a managed PostgreSQL database. We do not operate our own servers, and we rely on our providers for physical security, host hardening and platform patching.
Credentials and connection strings are held as environment secrets in the deployment platform. They are not committed to source control.
Encryption
All traffic to this site and our APIs is served over HTTPS, with TLS terminated by our hosting provider and HTTP requests redirected to it.
Data at rest is encrypted by our managed database provider using their platform default.
Access control
Access to production systems is limited to the people who need it to operate the service, through the identity controls of the underlying platforms, and is removed when someone no longer needs it.
Application accounts are authenticated per user. We do not use shared logins for production access.
Public endpoints
The enquiry endpoint behind our contact forms is deliberately unauthenticated — it has to be, since anyone may write to us. It accepts a fixed set of fields, validates them server-side, and rejects anything else.
Submissions that fill a hidden field no human ever sees are treated as automated and discarded.
Certifications
We do not currently hold SOC 2, ISO 27001 or any equivalent certification, and we have not completed a third-party audit. We will say so here when that changes, with the date and the scope.
We would rather lose a deal on this page than win one on a claim we cannot evidence.
Vulnerability disclosure
If you find a security issue in this site or our services, please tell us before you tell anyone else. Use the contact form and mark the message for our security team, and we will confirm receipt.
We will not pursue or support legal action against anyone who reports an issue in good faith, who avoids privacy violations and service degradation while investigating, and who gives us reasonable time to fix it before publishing.
We do not currently run a paid bug bounty.
Incident response
If we become aware of a breach affecting personal data, we will investigate, contain it, and notify affected people and any relevant regulator within the timescales the law requires.
We will tell you what happened, what we know, and what we are doing about it, rather than the minimum we can get away with.