Security

1. Our approach

Security is part of how we build rather than a review at the end. Every engagement includes threat modelling proportionate to the risk, secure defaults, dependency scanning in CI, and a documented plan for what happens when something goes wrong.

2. Infrastructure and data protection

• Encryption in transit — TLS 1.2 or above everywhere, with HSTS on our web properties.
• Encryption at rest — provider-managed encryption on databases, object storage and backups.
• Access control — least privilege by default, role-based permissions, and access reviewed when a role changes.
• Multi-factor authentication — required on every administrative and cloud account.
• Secret management — credentials held in managed secret stores, never in source control, and rotated on a schedule and after any staff change.
• Network isolation — production separated from staging and development, with no shared credentials.
• Backups — automated, encrypted and periodically test-restored.
• Logging and monitoring — structured logs with alerting on anomalies and failed authentication.

3. Secure development

• Every change is peer reviewed before it reaches production.
• Automated dependency and vulnerability scanning runs on every build.
• Static analysis and linting are enforced in CI.
• Inputs are validated server-side; output encoding guards against injection.
• Authentication and session handling use well-reviewed libraries rather than bespoke code.
• Passwords, where we store them at all, are hashed with a modern memory-hard algorithm.
• Security-relevant decisions are documented so they survive a change of team.

4. Organisational measures

• Confidentiality obligations in every staff and contractor agreement.
• Security awareness training, including phishing recognition.
• Company devices encrypted, with screen lock and remote wipe.
• Access removed the same day someone leaves.
• Suppliers assessed before they handle client or personal data.

5. Incident response

If a security incident occurs we contain it, investigate the scope, notify those affected, remediate, and write up what happened and what changes as a result.

• Personal data breaches are reported to the Information Commissioner's Office within 72 hours of us becoming aware, where the breach is likely to result in a risk to people's rights and freedoms.
• Affected individuals are notified without undue delay where the risk to them is high.
• Affected clients are notified without undue delay where we act as their processor, so they can meet their own obligations.

6. Responsible disclosure

We welcome reports from security researchers and will not take legal action against anyone acting in good faith under the guidelines below.

How to report

Email security@techgptltd.com with:

• A description of the vulnerability and its likely impact;
• Clear steps to reproduce it, including any URLs or accounts involved;
• Any proof-of-concept material, kept to the minimum needed to demonstrate the issue;
• How you would like to be credited, if at all.

What we ask

• Give us reasonable time to investigate and fix before disclosing publicly — 90 days is our normal expectation.
• Do not access, modify or delete data belonging to anyone else. Use only test accounts you control.
• Do not run denial-of-service tests, send spam, or use social engineering against our staff or users.
• Do not exploit a vulnerability beyond the minimum needed to demonstrate it.

What we commit to

• Acknowledge your report within 3 business days.
• Give an initial assessment within 10 business days.
• Keep you updated as we work on a fix.
• Credit you publicly when the fix ships, if you would like that.

We do not currently operate a paid bug bounty programme. That does not make a good report any less welcome.

7. Out of scope

The following are generally not treated as vulnerabilities on their own: missing security headers with no demonstrated impact; results from an automated scanner without a working proof of concept; social engineering; physical attacks; denial of service through volume; issues requiring a rooted, jailbroken or already-compromised device; self-XSS; email spoofing where SPF, DKIM and DMARC are correctly configured; and reports about third-party services we do not control.

8. Contact

Security reports: security@techgptltd.com
Privacy and data protection: privacy@techgptltd.com
TechGPT Ltd, [Registered Office Address], United Kingdom