Legal and compliance
Security & Hosting Statement
Encryption, backups, hosting location and certification, for a council's cyber security review.
This statement is for a council's cyber security review. It describes what is actually configured on this installation, not a general policy — where a control depends on how the service is deployed, the page says which way it is set rather than claiming the better answer.
Certification
Cyber Essentials certification details have not been published on this installation. Ask your supplier for the current position rather than assuming either way.
Encryption in transit
- TLS 1.3, with TLS 1.2 available only for older clients and weak ciphers disabled.
- HTTP Strict Transport Security, so a browser that has visited once will not fall back to an unencrypted connection.
- All cookies marked Secure, HttpOnly and SameSite=Lax, and prefixed __Host- so each is pinned to this exact origin.
- Certificates obtained and renewed automatically from Let's Encrypt.
Encryption at rest
- Credentials and API keys — sealed with AES-256-GCM, each bound to the setting it belongs to so a ciphertext copied from one field into another fails to open. The encryption key is held outside the database.
- Session tokens — never stored. The database holds a SHA-256 hash, so a copy of the database contains nothing that could be used to sign in as anybody.
- Sign-in codes — stored as a keyed HMAC, not as the code.
- The database as a whole — whole-volume encryption at rest is not enabled on this installation. Application-level encryption of credentials and hashing of tokens, described above, apply regardless. If your authority requires full-volume encryption, it can be enabled at deployment — ask.
Authentication
There are no passwords. Signing in sends a single-use code to a work email address, valid for 10 minutes, bound to the browser that requested it and rate-limited per address and per network. There is therefore no password store to breach, no password reuse to inherit, and no password reset flow to attack.
Sessions last 14 days and expire after 12 hours idle. A user can end every session on every device from their account page.
Access control
- Reports are scoped to an organisation. Every read of report data carries its owning organisation in the query itself rather than filtering afterwards, and an unscoped query is rejected by the data layer rather than quietly returning everything.
- Roles are owner, member and viewer, set per organisation.
- The administration console is separately gated and every refused attempt is logged.
- Every state-changing request carries a cross-site request forgery token that is verified against both a keyed MAC and the request's origin.
Application security
- A content security policy of default-src 'self' with a per-request nonce for the one script. No third-party script, stylesheet, font or image can load — fonts are vendored precisely so that nothing leaves the origin.
- All database access through parameterised statements. No query is built by string concatenation of user input.
- Output escaped by the template engine by default, with no raw-HTML escape hatch available to page authors.
- Upload size limits, content-type checks and X-Content-Type-Options: nosniff on every download.
- Written in Go, statically compiled, with no C dependencies and therefore no class of memory-safety bug in the application or its database driver.
- Dependencies checked against the Go vulnerability database on every build.
Outbound connections
The service makes outbound requests in only three circumstances, and each is bounded:
- GOV.UK, to refresh published statistical tables. Read only; no data is sent.
- Research, when enabled, to a list of permitted domain suffixes an administrator controls — gov.uk by default — through a dialler that refuses any address which is not public unicast, so it cannot be turned inwards at internal infrastructure.
- Email and the AI provider, only where an administrator has configured them.
There is no telemetry, no analytics and no phone-home of any kind. The service ships with a copy of the published statistics and works with no internet access at all.
Hosting
| Provider | Akamai Technologies (Linode) |
|---|---|
| Region | United Kingdom |
| Data residency | All customer data held in the region above. No transfer outside the UK or EEA. |
| Architecture | A single Go binary and a SQLite database file. No external database server, no message broker, no cache tier — fewer moving parts is itself a security property. |
Backups and recovery
- Schedule: Daily, retained for 14 days.
- Snapshots are taken with SQLite's own consistent-copy mechanism, so a backup is never a half-written file.
- 14 snapshots are retained.
- Uploaded document files are stored on disk beside the database and are covered by the host's own volume backups rather than the database snapshot. That is stated plainly because it is the sort of thing that is otherwise discovered during a restore.
Logging and monitoring
- An append-only audit log of security-relevant actions: who, what, when, and a truncated IP address. It is never purged, because a log that can be trimmed is not evidence of anything.
- Failed sign-ins, refused administration attempts and rate-limit trips are all recorded.
- IP addresses are truncated before storage — the last octet answers no question this service needs to ask.
Incident response
A personal data breach affecting an authority's data is reported to that authority without undue delay and within 24 hours of us becoming aware, with what is known at the time. The full undertaking is in the Data Processing Agreement.
To report a vulnerability, email contact@infin8.digital. We will acknowledge within 2 working days. We will not take legal action against anyone acting in good faith who reports a genuine issue and gives us a reasonable chance to fix it before disclosing it.
Testing
You may security test this service against your own installation. Ask first so we can agree a window and know it is you rather than an attack, and please do not test against another authority's data.
Contact
Questions about this document go to contact@infin8.digital.
A registered address has not been published on this installation.