Our approach
We build software for organisations whose work depends on it, including transport operators and GP practices. That means designing for security from the start, keeping access tight, and being honest about what we do and do not claim.
This page is a public overview. It does not describe every control, and it is not a certification. We do not currently publish any third-party security certifications on this site; if we obtain any, we will say so here. Clients who need more detail for their own due diligence can ask us directly.
How we work
- Secure development: code review, typed and validated inputs, and security considered at design time rather than bolted on.
- Least privilege: staff and systems are given only the access they need, with role-based permissions in our administration tools.
- Multi-factor authentication for staff access to administration.
- Encryption in transit: the website and portal are served over HTTPS.
- Tenant isolation: each client’s portal workspace is separated, so one organisation cannot see another’s projects, messages or files.
- Passwordless portal sign-in: clients sign in with single-use email links, so there are no portal passwords to reuse or leak.
- Audit logging of sign-ins and significant administrative actions.
- Data minimisation: we collect only what we need, store IP addresses only as a keyed hash for abuse prevention, and anonymise enquiry records after our retention period. See our privacy notice.
- Dependency updates: we keep frameworks and libraries up to date and act on security advisories.
What we ask of you
Please do not send patient-identifiable information, clinical records, passwords, API keys or other credentials through our website forms or by email. The general enquiry forms are not designed for sensitive data, and we will never ask you for your password. If we need sensitive information for agreed work, we will arrange an appropriate route with you.
Reporting a vulnerability
If you believe you have found a security vulnerability in this website, our client portal or one of our products, please tell us privately so we can fix it before it is exploited.
Use our contact form and choose “Security report”. Keep the first message brief; we will arrange a suitable way to exchange details if needed.
Please do not disclose the issue publicly until we have had a reasonable opportunity to investigate and fix it.
What to include
- the affected website address, product or component;
- a description of the issue and its potential impact;
- clear steps to reproduce it, and a proof of concept if you have one;
- the date and time of your testing, and any IP addresses or accounts you used;
- how you would like to be credited, if at all.
Do not include any personal data you may have encountered. Describe what was exposed rather than sending it.
Testing guidelines
When researching, please:
- do not access, modify or delete data that is not yours. If you encounter someone else’s data, stop, do not keep a copy, and tell us;
- do not run denial-of-service tests, or anything that degrades the service for others;
- do not use social engineering, phishing or physical attacks against our staff, clients or premises;
- do not use automated scanning that generates large volumes of traffic or form submissions;
- only test against accounts you own or have explicit permission to use;
- do not test systems belonging to our clients or third-party service providers.
What happens next
We will acknowledge your report, investigate it and keep you informed of our progress where we can. If we confirm the issue, we will work to fix it and, if you wish, credit you once it is resolved. We do not currently run a paid bug bounty programme.
Good-faith research
If you make a good-faith effort to follow this policy, we will treat your research as authorised in the sense that we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue. If a third party takes action against you over research carried out in line with this policy, we will make it known that you acted in accordance with it.
This statement does not authorise testing that breaks the guidelines above or the law, and it cannot grant permission on behalf of third parties.