Security

How we look after your information.

Written plainly, and without claiming anything we have not actually done.

On ISO 27001. We are not ISO 27001 certified. That certification applies to an organisation's whole information security management system and is awarded only after an audit by an accredited certification body — it is not something a website can hold. What follows describes measures we genuinely have in place, organised around the themes ISO 27001 Annex A covers, so you can judge them for yourself. If certification is a procurement requirement for you, tell us and we will discuss it honestly rather than imply we have it.

Access control

Administrative access sits behind a password held as an environment variable, never in code. Sign-in attempts are compared in constant time, deliberately slowed, and rate-limited per address. Sessions are cryptographically signed, marked HttpOnly and Secure, and expire after twelve hours. Access to the administrative area is blocked at the network edge, so an unauthenticated request never receives the page at all.

Cryptography and transport

Everything is served over HTTPS with HTTP Strict Transport Security. Session tokens are signed with HMAC-SHA256. Client-facing proposal and contract links use 24 bytes of cryptographically random data, making them impractical to guess.

Application security

A Content Security Policy restricts what the browser will execute or load. All output is escaped before it reaches a page. File paths written to storage are checked against a strict allowlist. Actions that matter — accepting a proposal, signing an agreement — require the request to have come from this site. Input is length-limited and range-checked on the server, not only in the browser.

Supplier management

We keep our supplier list short and publish it in full in our privacy notice, with what each one does and where it holds data. Each acts under a data processing agreement, whether that is one contained in their standard terms or one signed separately.

Data minimisation and retention

We collect the least we can and delete it on a schedule set out in the privacy notice. We do not run analytics or advertising trackers, and this site sets no cookies for ordinary visitors.

Logging and monitoring

Hosting and database platforms provide access and error logging. Proposal activity is recorded so we know where a quote stands; that record is described in the privacy notice and deleted with the rest of the project file.

Reporting a problem

If you believe you have found a security issue, email hello@t19digital.co.uk with enough detail to reproduce it. We will acknowledge within two working days and keep you updated. Please give us reasonable time to fix it before publishing, and do not access, alter or delete anyone else's data while testing. We will not pursue anyone who reports in good faith and follows this.

If something goes wrong

If a personal data breach occurs and it is likely to risk people's rights, we will report it to the ICO within 72 hours of becoming aware, and tell affected people directly where the risk is high.

Last updated 21 August 2026. We will post any changes here and update this date.