How we protect systems and data

Administrative access

Admin access needs multi-factor authentication. People get only the permissions their role needs, and we remove access when it is no longer needed.

Encryption

Traffic to our public sites is encrypted with HTTPS. Stored data and secrets use the encryption provided by the platform they run on. Encryption keys are kept outside our code repositories.

Operational resilience

We have documented backup and restore procedures, and recovery plans for each service. Your service schedule sets out what is covered and who is responsible. This page does not set a contractual recovery time.

Incident response

We have an incident response process. It covers triage, containment, investigation, recovery, evidence and communication. Privacy incidents follow the same process, plus the extra assessment that data protection law requires.

Responsible disclosure

Report a suspected security issue privately to security@inclusiveitsolutions.co.uk. Include the affected service, a reproducible description and a safe way to contact you. Do not access data that is not yours or disrupt a live service.

Privacy contact

Privacy questions and rights requests can be sent to david.kirkman@inclusiveitsolutions.co.uk. See the privacy notice for website processing.