Security Policy
The technical and organisational measures we use to protect this site and the personal data you send us.
Last updated: 23 August 2026
UK GDPR Article 32 requires appropriate technical and organisational measures. This page explains what we do in practice. What we collect and why is in the Privacy Policy. Rights and lawful bases are summarised in the GDPR Policy.
1. Our commitment
We take reasonable steps, appropriate to a small UK digital business, to protect against unauthorised access, loss, alteration and misuse of personal data. We follow ICO expectations and, where useful, NCSC small-business guidance.
2. HTTPS and encryption
Traffic to and from this site is encrypted with TLS (HTTPS). That protects quote form submissions in transit. Use a current browser and avoid sending personal data on a network you do not trust.
3. Security headers
We set HTTP security headers, including:
- Strict-Transport-Security (HSTS) - browsers should use HTTPS only
- Content-Security-Policy - reduces the risk of cross-site scripting
- Subresource Integrity (SRI) - first-party CSS and JavaScript are integrity-checked in the browser so tampered files are blocked
- X-Content-Type-Options - stops MIME-type sniffing
- Referrer-Policy - limits what referrer data is sent to other sites
- Permissions-Policy and frame controls - reduces unnecessary browser features and clickjacking risk
4. Form and data handling
Quote submissions are validated and sanitised to reduce injection and abuse. We use a CSRF token, an IP-backed attempt limit, a submission cooldown, a honeypot and Cloudflare Turnstile. We do not store submissions in a public website database; they are emailed to us and handled under the Privacy Policy. We do not sell or rent your data.
Use of the form is also covered by the Terms of Service.
5. Email
Enquiry email is handled with Proton Mail. Proton provides end-to-end encryption, encrypts mail at rest, protects messages in transit, and restricts access so only authorised mailbox holders can read correspondence. We use strong authentication on the account. Quote replies and ongoing client email benefit from the same Proton security model.
6. Sessions and cookies
The homepage uses one secure session cookie (__Host-Session: HttpOnly, Secure, SameSite) for form security and a submission cooldown. Static service, legal and error pages do not create it on their own. Session identifiers are regenerated when appropriate. Full detail is in the Cookie Policy.
7. Servers and access
Our hosting provider manages the underlying platform; we apply application and configuration updates that are under our control. Administrative access is restricted and unnecessary public paths are denied. Access follows least privilege where practicable.
8. Security checks and HSTS
We use code review and automated or third-party checks when assessing known vulnerabilities, common web flaws, TLS configuration and header hygiene. Findings are prioritised by risk and fixes are checked again.
The site sends an HSTS header with the preload directive. That makes it eligible for browser preload submission; the header by itself does not guarantee that every browser’s preload list currently contains the domain.
9. Personal data breaches
If a personal data breach is likely to result in a risk to your rights and freedoms, we will:
- Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware (unless the breach is unlikely to result in a risk)
- Notify you without undue delay if the breach is likely to result in a high risk, so you can take steps such as watching for suspicious email
We will record the facts, effects and what we did about it, as UK GDPR requires. How to exercise your other rights is in the GDPR Policy.
10. Reporting a vulnerability
If you think you have found a security issue, please tell us privately first via the contact page or our security.txt file. We will acknowledge it and, where appropriate, work with you on a fix. Please do not publish the issue until we have had a reasonable chance to respond.
We will not take legal action against researchers who report in good faith and do not exploit the issue or access other people’s data.
11. Limits
No website can be guaranteed secure. Keep your own devices and software updated. We are not responsible for loss caused by events outside our reasonable control, such as a sophisticated attack on a third-party provider. Liability for use of the site is set out in the Terms of Service.