Information Security Statement

The Group describes only arrangements that can be verified, rather than asking to be taken on faith. Where a standard is mentioned, the Group draws on it; it does not claim certification (see section 4).

Everyone who works for the Group receives security and fraud-awareness training, including on phishing, when they join and at least once a year. The training is mandatory.

Five habits that keep you safe.

• Share data carefully — send as little as you need, to as few people as you need.
• Think before you click — pause before opening a link or attachment, especially if it is urgent.
• Use strong passwords — long, unique, with multi-factor authentication switched on.
• Limit what you share online — check your privacy settings.
• Keep devices updated — install updates to software, systems and apps.

Passwords for shared documents are always sent by a different channel from the document itself. Documents shared with partners are available for a limited time, then removed.

1. Approach

Resilience is less about avoiding every attack than about continuing to operate when safeguards are compromised. Technology informs the decision; the Board makes it. The Group’s approach to information security is proactive and adaptive. It treats security as a design principle rather than a feature. Protection is built into systems from the start and is not traded away for ease of use.

2. Measures

The Group has controls designed to detect, respond to and recover from security incidents; see the Business Continuity Statement.

• Access — personal accounts only; least privilege; multi-factor authentication for all administrative access; passkeys for closed areas.
• Encryption — encryption in transit (TLS) for the website and email; encryption at rest for stored documents.
• Email and domains — sender authentication (SPF, DKIM, DMARC) and protection of the Group’s domains against impersonation.
• Website — no third-party advertising or session-recording scripts; security headers; minimal attack surface.
• Backups and continuity — regular backups and documented recovery procedures.
• Suppliers — security requirements set out in the Supplier Code of Conduct and in contracts.
• Post-quantum readiness — an inventory of cryptographic keys and a migration plan aligned with the NCSC timeline (2028 / 2031 / 2035).

3. Reporting a vulnerability

Security researchers can report a vulnerability through Regulatory and compliance in Enquiry channels. The security contact is also published in /.well-known/security.txt. The Group will not take legal action against good-faith research that respects users’ privacy and does not disrupt services. See the Vulnerability Disclosure Policy.

4. Certifications

The Group names only certifications it actually holds. None are claimed at the date of this statement: the Company does not claim certification to ISO/IEC 27001, SOC 2 or PCI DSS. Its arrangements draw on these standards.

5. Questions about security

• Is the Group regulated? No. The Company is not authorised or regulated by the FCA or the PRA; see Regulatory status.
• How is my data protected? See the Privacy and Cookie Policy.
• How do I report a vulnerability? See the Vulnerability Disclosure Policy.
• How do I report a message that pretends to be from the Group? See Official channels.
• Does the Group hold security certifications? No; see section 4.