Security

2. Infrastructure

Core application data is hosted in the United Kingdom.

• Database hosted on Neon PostgreSQL in the aws-eu-west-2 (London) region
• Application servers hosted on Fly.io in London
• Website and CDN delivered by Cloudflare's edge network
• All connections encrypted with TLS 1.2 or higher
• HTTPS enforced across all endpoints with HSTS headers

3. Encryption

We use field-level encryption to protect sensitive personal and financial data at rest.

• AES-256-GCM encryption for sensitive fields including names, emails, and salaries
• Per-tenant encryption keys, so each organisation's data is encrypted with its own key
• Blind indexes (HMAC-based) enable search over encrypted data without decryption
• Encryption keys are managed separately from application data

6. Application security

We implement comprehensive web application security controls.

• Rate limiting on all API endpoints
• HTTP Strict Transport Security (HSTS) headers
• X-Frame-Options and Content-Security-Policy headers to prevent clickjacking
• CORS policies restricting cross-origin requests
• Authentication and session management via Clerk

7. Data retention

We follow clear data retention and deletion policies.

• Account data retained while the account is active
• Staff records removed from the application on deletion, with personal data permanently anonymised within 30 days
• Audit logs retained for 1, 3 or 5 years based on your plan tier, or 90 days where no plan is in place
• Audit logs permanently deleted 90 days after their retention period expires
• Database backups retained for 7 days for disaster recovery

9. Incident response

We maintain an incident response process to handle security events promptly.

• Affected customers will be notified within 72 hours of a confirmed data breach, in line with UK GDPR requirements
• Incident reports include the nature of the breach, data affected, and remediation steps taken
• Post-incident reviews are conducted to prevent recurrence

10. Security reviews

We conduct regular security reviews of our infrastructure and application code. This includes dependency auditing, code review, and periodic assessment of our security controls.

11. Backup and disaster recovery

Database backups are taken daily and retained for 7 days. Our infrastructure is designed for high availability with automated failover. In the event of a major incident, we target recovery within 24 hours.

12. Internal access controls

Access to production systems and customer data is restricted to essential personnel only. All access is logged and reviewed. We follow the principle of least privilege across our infrastructure.