Security designed into the whole system

Is our business data encrypted?

Connections to a published system are protected using HTTPS and modern TLS encryption. This protects information while it travels between a user's device and the system.

The managed database service also provides encryption for stored database data. Where a system connects to another service, we use secure server-side connections and keep private credentials out of the browser.

Can we control who sees different information?

Yes. Access can be designed around roles and responsibilities, so a person sees only the records and actions needed for their work. Rules can be applied at the data level, not just by hiding a screen or menu item.

For example, an engineer might see assigned visits while a manager sees the wider operation. Administrative permissions are kept separate from ordinary user access.

How are passwords and sign-in protected?

Systems can use managed email sign-in and, where appropriate, social sign-in. Password handling is provided by the managed authentication service rather than being improvised inside the application.

Additional options can include password-reset controls and checking for known compromised passwords. The exact sign-in policy is agreed for each system; specialist corporate identity requirements are scoped separately.

Are security checks carried out?

Yes. The professional delivery environment includes automated checks for vulnerable software dependencies, database access rules and common application security issues. Deeper code and access-control reviews are also available during development and before important releases.

Essential Systems is Cyber Essentials Plus certified, and our reusable core platform has undergone independent penetration testing. Automated scanning remains a valuable safety net, but no scanner or test can guarantee that a system is completely secure.

What happens if data needs to be restored?

The managed database is backed up daily, with a rolling retention period of approximately 14 days. This supports database recovery when required.

Uploaded files are stored separately from database backups, so file retention and recovery requirements should be agreed as part of the system design. We make that distinction clear rather than implying that every file is covered by a database restore.

Does this make the system compliant with every regulation?

No technology platform can make a business compliant by itself. Security controls support good governance, but compliance also depends on what information you collect, why you collect it, who has access, how long it is retained and how your team works.

During discovery we identify sensitive workflows and can design appropriate access, retention and audit requirements. Our organisational certification and core-platform testing provide a strong baseline; additional system-specific testing or legal assurance is scoped where the information or contractual requirements justify it.

Is our data used to train AI?

Where a system uses AI features, requests are sent securely from the server and only the information needed for that task is included. We agree with you during discovery which information, if any, may be processed by AI features.

Where is our data stored?

Data is held with managed cloud database and hosting providers. Specific locations and subprocessors are listed in the customer security pack, and data-residency requirements can be discussed during discovery.

What happens if there is a security incident?

We investigate, contain the issue, correct the cause and inform affected customers without undue delay, supporting you with any notifications you need to make. Our incident-response process is included in the customer security pack.