§ · Security & compliance
Built for systems that hold real records.
Our systems carry government casework, payments and personal records, so security is part of the platform every project ships on instead of an add-on negotiated later. This page describes what we actually do on every deployment. If a question isn't answered here, ask us directly and we'll answer it plainly.
01
Access control
Every user gets exactly the access their job requires and nothing more. Permissions follow roles, with per-user adjustments where a role alone is too broad.
- Role-based permissions across every screen and record type
- Per-user overrides for exceptions, without inventing new roles
- Least-privilege defaults: every access has to be granted explicitly
- Field-level and row-level restrictions where data is sensitive
02
Authentication
Getting in requires more than a password. The system enforces the sign-in policy, so it does not rely on user discipline.
- Strong password policy enforced on every account
- One-time codes as a second factor
- Trusted-device checks: a new device must be verified before it gets in
- Session limits and automatic sign-out on inactivity
03
Audit trail
Every action in the system leaves a record: who did it, what changed, and when. The history is append-only, so it can be read but never rewritten.
- Who / what / when captured on every record
- Approvals, rejections and corrections all traceable to a person
- Append-only history: records cannot be edited or deleted
- Audit views available to authorised reviewers on demand
04
Data protection
Client data stays separate and stays encrypted in transit. Each client runs against its own database, so no client's data sits in a shared pool beside another's.
- Encrypted transport on every connection
- Isolated per-client databases, with no shared tenants
- Data access restricted to the client's own system and staff
05
Backups & continuity
Backups run on schedule, and we test the restores instead of assuming them. Uptime is watched from outside the system, so we find out about a problem before you phone us.
- Scheduled backups at multiple intervals
- Restore procedures are tested on a schedule
- External uptime monitoring with alerts
- Production error tracking so faults surface immediately
06
Responsible hosting
Systems are hosted where the client needs them, on servers we harden and maintain. Security checks are part of routine maintenance instead of a one-off exercise at go-live.
- EU or local hosting options, chosen with the client
- Server hardening as standard on every deployment
- Security scanning carried out during maintenance windows
- Dependencies kept current against published vulnerabilities