Trust
Security, and what we have not done yet.
Your rates are the most commercially sensitive thing you own. Here is how they are protected, and where the gaps still are.
In place
What protects your data today
Encrypted in transit
Every connection uses HTTPS with a certificate from a public authority. The application refuses to serve anything over plain HTTP.
Per-user accounts and roles
Named accounts with roles and permissions, not one shared login. Every change to a rate, estimate or customer records who made it and when.
Session and request protection
Session cookies are HttpOnly and SameSite-Strict, every state-changing request carries a CSRF token, and repeated failed sign-ins are throttled.
UK hosting
Data is held on servers in the United Kingdom and is not transferred outside it.
Backups
The database is backed up daily and retained, so a mistake on Tuesday does not cost you Monday's work.
A very small dependency surface
The server is written in Go with no third-party libraries at all. Most breaches of small software companies come in through a dependency; there is almost nothing here to compromise.
Not yet
What is still outstanding
Publishing this list is unusual. We would rather you judged us on an accurate account than a reassuring one, and every item below is being worked through before general release.
| Item | Status |
|---|---|
| Independent penetration test | Not yet carried out |
| Password hashing upgrade to a memory-hard algorithm | In progress |
| Two-factor authentication | Planned before launch |
| Self-service password reset | Planned before launch |
| Encryption of files at rest | Planned |
| Formal ISO 27001 or Cyber Essentials certification | Not held |
What this means for early access
During early access, use demonstration or historical data rather than live customer pricing you would be damaged by losing. We will tell you plainly when that advice changes.
Reporting
Found something?
If you believe you have found a security problem, email security@r77fitforge.co.uk. Tell us what you found and how to reproduce it. We will acknowledge within five working days.
Please do not run automated scanners against the service, access data that is not yours, or degrade the service for other users. We will not pursue anyone who reports a genuine issue in good faith and gives us reasonable time to fix it.