Cyber Essentials certified. UK data centres only. Quarterly penetration testing. Your data stays where it should, under your control and protected by real security measures.
Certifications
We don't just say we're secure. We prove it with recognised certifications.
Government-backed certification for cyber security. Passed, not pending. We meet the baseline for protecting against common cyber attacks.
Built for UK and EU data protection requirements. Data processing agreements, subject access requests, and right to deletion built in.
Data Protection
Your data stays in the UK. Not routed through servers abroad. Not stored in jurisdictions with different data laws. UK data centres only.
All data encrypted when stored. AES-256 encryption. Even if someone accessed the physical storage, your data would be unreadable.
TLS 1.2+ for all connections. Your data is encrypted between your browser and our servers. No exceptions.
Control who sees what. Granular permissions by role, team, or individual. Users only access what they need.
154+ event types logged. Every login, every change, every access. Full trail of who did what and when. Exportable for compliance.
API keys with granular permissions. Rate limiting. IP allowlisting available. Secure integration without exposing your system.
Access Control
Granular permissions. Multi-factor authentication. IP restrictions. You decide who gets in.
Optional 2FA for all users. TOTP-based. Add an extra layer of security to every login.
Restrict access by IP address or range. Lock down access to your office network if required.
Automatic session timeout. Force logout across devices. See active sessions and revoke access.
Each customer's data is logically isolated. No cross-tenant data access. Your data is yours alone.
Least privilege in practice
“Granular permissions” is what every vendor says. Here is the actual mechanism, in the order it runs, so you can judge whether it covers the confidentiality your operation has to hold. Each layer can deny on its own.
Role
Roles bundle capabilities, from standard user through team leader to internal admin, alongside granular roles for specific powers such as managing file tags or approving permission requests. A role is granted by a named administrator and the grant is logged.
Workflow
Visibility is set per team member, per workflow, and down to individual statuses within a workflow. Someone handling intake can be shown the first three stages of a process and nothing beyond them.
Product
A task type can be marked restricted, which means holding a role is no longer enough. Access then depends on having an active assignment on the case itself. Allow rules form a whitelist by case relationship, and a deny rule always wins over an allow.
Case
Case relationships decide what a person sees on the case in front of them. The same user can be case owner on one, an expert on another, and hold no relationship at all to a third, which is what makes note and form visibility workable without maintaining lists by hand.
Field
Forms, actions and notes each declare which user types can see them, and visibility rules can hide content until named questions are answered. Files carry their own permissions, separate from the documents they relate to.
A restricted task type can also be kept out of listings entirely, configured independently of who may open it. Cases that should not advertise their existence do not appear in a count, a search result or a report for anyone without access.
Users request a role rather than being handed one informally. The request sits pending until a permissions manager grants or denies it, and the request, the decision and the person who made it are all recorded for the access review you will eventually be asked for.
Audit Trail
Every action logged. Every change recorded. When auditors ask what happened, you have the answer. Exportable reports for compliance reviews.
What we promise you.
Your data is yours. We don't sell it, share it, or use it for anything except running your system.
If something goes wrong, you'll know. We disclose security incidents promptly and clearly.
Ongoing security assessments. We don't set and forget. We continuously improve.
Security questions answered by real people in the UK. Not outsourced, not scripted.
Data Processing
Full transparency on data processing, sub-processors, and data flows. Everything your DPO needs to complete a vendor assessment.
We provide a comprehensive DPA covering GDPR Article 28 requirements. Includes data processing purposes, categories of data subjects, security measures, and sub-processor obligations.
Available on request before contract signingWe use a limited number of sub-processors, all UK or EU-based. Our primary infrastructure runs on UK data centres. We notify customers before adding any new sub-processor.
Current sub-processor list available on requestConfigurable data retention policies per workflow. Automated deletion schedules. Complete data export in standard formats. Full deletion on contract termination with certificate of destruction.
Retention periods configurable per case typeExport your data at any time in CSV, JSON, or XML formats. No vendor lock-in. Your data is yours and you can take it with you.
Self-service export available in all tiersCompliance Journey
Achieved Cyber Essentials certification, the UK government-backed scheme for cyber security. Renewed annually since.
Full GDPR compliance programme including DPA templates, DSAR handling, and data protection impact assessments.
Need to complete a vendor security assessment? We can provide pre-completed responses to standard security questionnaires including CAIQ, SIG, and bespoke formats.
We're happy to discuss our security measures, provide documentation for your compliance team, or answer specific questions about how we protect your data.
