Security

How we protect client systems

The servers we run for clients have no open inbound ports. Engineers manage them over a private, encrypted mesh.

Backups are copied off-site and encrypted, and we restore them every month to check they work. We monitor the servers day and night.

The details are on our hosting and security page.

Report a vulnerability

If you think you have found a security problem in our website or in a system we run, please tell us.

Email [email protected] with the subject “Security”.

What to include

• where you found it, such as the page or address
• what you did and what you saw
• steps that let us repeat it
• your name and how to reach you, if you want a reply

What happens next

We will acknowledge your report and keep you informed as we look into it.

What we ask of you

Please give us reasonable time to fix the problem before you tell anyone else.

Please do not harm data or availability while you test. Do not read, change or delete data that is not yours, and do not slow down or take down a service.

Please do not use social engineering, such as phishing or tricking our staff or clients.

Thank you

Thank you for helping us keep our clients’ systems safe.

Our security.txt file lists the same contact for automated tools.