Security and compliance
We treat your product as if it were ours, and your data as if it were yours.
This page sets out the practices we follow on every asset we run.
Our practices
Six things we do on every asset.
Access
- Named accounts only, never shared logins
- Least privilege: only what each task needs
- Two-factor authentication wherever the service offers it
- Access reviewed quarterly and removed the day it's no longer needed
Secrets
- API keys and passwords live on the server or in a password manager
- Never in code, tickets, email or chat
- Rotated when someone leaves or a leak is suspected
- Only names, never values, appear in our documents
Backups
- Automatic, encrypted where the data is personal
- A copy kept away from the main server
- Restores tested on a schedule, not assumed
- Retention agreed with you and written down
Patching
- Security updates applied on a regular schedule
- Urgent fixes for actively exploited flaws applied fast
- Every release can be rolled back
- Changes recorded in the change log
Edge and web
- HTTPS everywhere, with HSTS
- Strict security headers and content policy
- CDN and firewall in front where it helps
- Rate limits on logins and forms
Incidents
- A written plan for each asset: who does what, in what order
- You're told promptly, in plain words
- Help with any regulator or user notifications you need to make
- A written review afterwards, with what we're changing
Data protection
Your users' data stays yours.
When we run your product we act as your processor: we handle personal data only on your instructions and only to provide the service. You remain the controller. Before we touch any personal data we put a written data processing agreement in place, covering what we process, why, where, for how long, and which sub-processors are involved.
- We use the minimum personal data the task needs, and we don't copy production data to our own machines.
- We tell you about any personal data breach without undue delay, so you can meet your own reporting duties (in the UK, the ICO's 72-hour deadline).
- We help you answer your users' data requests: access, correction and deletion.
- At the end of the engagement we return or delete the data, as you choose, and confirm it in writing.
Report a vulnerability
If you think you've found a security problem in this site or in a product we run, please email info@charterstonetech.com with "Security" in the subject. Tell us what you found and how to reproduce it. Please don't access other people's data, disrupt the service or make the issue public until we've had a fair chance to fix it. We'll acknowledge your report and keep you updated. Our contact details are also published at /.well-known/security.txt.