Security

Security by design

We build security considerations into application development, infrastructure configuration, access control and operational workflows. Controls vary by product and risk; this page deliberately avoids claiming certifications or controls that have not been independently established.

Corporate website protections

• HTTPS is used for public web traffic.
• Server-side validation is applied to public form submissions.
• Cloudflare Turnstile can be used to reduce automated form abuse.
• Contact Centre administration is separated from the public enquiry form and protected by access controls.
• Application and database backups are maintained as part of the operational workflow.

Reporting a vulnerability

If you believe you have found a security issue, please report it privately. Include enough information for us to reproduce the issue and avoid accessing, modifying or retaining data that is not yours. Do not publish sensitive vulnerability details before we have had a reasonable opportunity to investigate.