Security, privacy & trust
Security & privacy
Built to be audited, not just asserted.
Application security
Controls in the platform itself.
Defence in depth: transport, headers, input handling, authentication and monitoring — each independent of the others.
Encrypted transport
TLS 1.3 everywhere, HSTS with preload, no mixed content, and certificates rotated automatically before expiry.
Security headers
Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy set on every response.
Input handling
Every field is length-bound and typed, submissions are re-validated server-side, and content is rendered as text — never as markup.
Injection defence
Prepared statements only, strict output escaping, and uploads type-checked against their real contents.
Authentication
Administrative access uses multi-factor authentication, short sessions, and secure HttpOnly SameSite cookies.
Least privilege
Role-based access across editorial, commercial and administrative functions; approvals segregated from execution.
Rate limiting & bots
Per-IP throttling on forms and login, honeypot screening, and challenge on anomalous traffic.
Edge protection
WAF rules on the OWASP core rule set, DDoS absorption at the CDN, and the origin reachable only through the edge.
Logging & monitoring
Audit logs of privileged actions, centralised alerting, and a documented incident response runbook.
Backup & recovery
Encrypted, versioned backups tested by restore drill, with declared RPO and RTO targets.
Dependency hygiene
Pinned, integrity-checked third-party scripts, automated vulnerability scanning and a patch window for critical CVEs.
Data minimisation
We collect only what an enquiry needs, never request card details or passwords by email, and delete on request.
Response headers
What the edge sets on every request.
Published so your IT team can verify us independently rather than take our word for it.
-
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Forces HTTPS for two years across all subdomains and removes the downgrade window.
-
Content-Security-Policy
default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'
Scripts, styles and fonts load only from the origin and a pinned, integrity-checked allow-list.
-
X-Content-Type-Options
nosniff
Stops the browser re-interpreting a response as a different content type.
-
Referrer-Policy
strict-origin-when-cross-origin
Client identity and query parameters are not leaked to third parties.
-
Permissions-Policy
camera=(), microphone=(), geolocation=()
Device capabilities the site does not need are switched off, not merely unused.
-
X-Frame-Options
SAMEORIGIN
Prevents clickjacking by refusing to render inside third-party frames.
-
Cross-Origin-Opener-Policy
same-origin
Isolates the browsing context so cross-origin pages cannot inspect it.
Commercial assurance
Trust is a process, not a padlock.
Anti-fraud in trade
Bank details are never changed on the strength of an email. Any change is confirmed by call-back to a previously verified number.
Document integrity
Quotations, proforma invoices and certificates are issued from named company addresses; we will re-confirm any document on request.
Vendor screening
Suppliers are screened for sanctions and ownership before award, and re-screened at requalification.
Confidentiality
Client pricing, volumes and drawings are handled under confidentiality undertakings with access restricted to the deal team.
Report a concern
Vulnerability disclosure and privacy requests.
We do not pursue good-faith security researchers. Report privately first and allow time to remediate before publishing.
Honest scope
What a website can and cannot promise.
No site is “100% secure”, and any vendor who says otherwise is selling comfort rather than security. What can be promised is a small attack surface, third-party code pinned and integrity-checked, no secrets in the browser, every input treated as hostile, and controls that are written down, tested and independently verifiable.
The controls on this page describe the standard this platform is built and operated to. Penetration testing, header verification and dependency scanning are re-run on each release, and findings are remediated on a severity-based clock rather than at convenience.