Security and data privacy
Your website, accounts and customer data, protected.
Security isn’t an add-on. Every site and system we build ships with protection in place, and we handle your data in line with the Data Privacy Act of 2012.
Included in every build
Security essentials, from day one
These come standard with every package. Maintenance plans keep them current after launch.
HTTPS everywhere
Every site gets an SSL certificate, so forms, logins and checkout are encrypted.
Secure hosting
Managed hosting with a firewall, DDoS protection and automatic platform updates.
Two-factor admin logins
Admin panels use strong passwords plus a second step, so a leaked password isn’t enough.
Updates and patches
Frameworks, plugins and dependencies are kept current on every maintenance plan.
Encrypted backups
Automatic backups you can restore from, stored separately from the live site.
Spam and abuse protection
Forms are protected against bots and spam, and inputs are validated on the server.
Accounts and access
How we handle your logins
Most website problems start with shared passwords and forgotten access. We follow the same rules on every project.
- 01You add us as a user on your accounts. We don’t ask for your passwords.
- 02If a password must be shared, we use a password manager, never chat or email.
- 03Each team member only gets the access their part of the project needs.
- 04Access we no longer need is removed at the 30-day check-in after launch.
- 05Domains and accounts are registered to your business, so you always stay in control.
Backups and monitoring
What happens every week, on every plan
Every backup includes your website files and database, is encrypted, and is stored in a separate location from your host. Restores are tested every quarter.
Backup schedule
| Plan | Frequency | Kept for |
|---|---|---|
| Basic | Your host’s backups | Host’s terms |
| Standard | Weekly | 30 days |
| Premium | Daily | 30 days |
| Before updates or launch | Every time | Until the next good backup |
Security checks
| Check | Standard | Premium |
|---|---|---|
| Core, theme and plugin updates | Twice a month | Weekly |
| Malware scan | Monthly | Weekly |
| SSL certificate and HTTPS | Monthly | Weekly |
| Admin users review | Monthly | Monthly |
| Forms, payments and bookings | Monthly | Weekly |
| Uptime monitoring | Continuous | Continuous |
Basic plans include a monthly website check with updates; backups and security scanning come with Standard and Premium.
If something goes wrong
A clear response, hour by hour
If your site is ever compromised, this is exactly what happens, and who does it.
At once
Open an incident log and preserve evidence.
First hour
Contain it: change passwords, disable affected accounts, take the site offline if needed.
Within 24 hours
Tell you what happened, and whether personal data may be involved.
After containment
Clean the site or restore the last clean backup, then update everything.
Within 5 business days
Send you a written summary and the steps to prevent it happening again.
Data privacy
Built for the Data Privacy Act of 2012
When your site collects customer information, you’re responsible for it. We set it up so you can meet that responsibility.
Privacy notice and consent
Every form on your site gets a clear privacy notice and consent checkbox.
Collect only what’s needed
We design forms and databases to collect the minimum data your business actually uses.
Breach response
If an incident affects your data, we notify you and help you meet the 72-hour reporting rule.
Databases and storage
Your business data, organised and backed up
For booking systems, stores and custom systems, we design the database and storage behind them.
Structured databases
Bookings, orders, members and records in a properly designed database, not scattered spreadsheets.
Role-based access
Staff see only what their role needs. Owners can review who has access at any time.
Backups and exports
Automatic encrypted backups, and your data can be exported whenever you need it.
Contracts and legal
Everything in writing
Every project has a signed agreement and proposal. Our terms and privacy policy are public, so you can read them before we talk.
Worried about your current site’s security?
Send us the link. We’ll check HTTPS, updates, backups and admin access, and tell you what needs fixing, free.