Security

Last updated: 10 November 2026 · Version 1.3

---

We look after email, websites, backups and devices for organisations across mid Wales and the borders. That means we hold a lot of access we have to deserve.

This page describes how we approach that. We have tried to write it so you can tell what we actually do from what we intend to do, because a security page that blurs the two is worth nothing.

---

Compliance monitoring

We use CyberSmart to monitor endpoint compliance continuously — device configuration, patch status, encryption and security settings — rather than checking once a year and hoping nothing drifts in between.

---

How our hosting platform is protected

Web application firewall. Our servers run Imunify360, which inspects incoming requests and blocks known attack patterns before they reach your website or its database.

Malware scanning. Hosted files are scanned on an ongoing basis, with automated cleanup and alerting.

Runtime protection. Proactive Defense monitors code execution on the server and terminates malicious activity, which catches attacks that get past pattern matching.

Brute-force protection. Repeated failed logins against mail and hosting accounts are detected and the source blocked automatically. Our mail platform is checked every ten minutes by a monitoring process that blocks attacking addresses and alerts us to accounts failing repeatedly.

Firewall. Network-level filtering with automatic blocking of hostile sources, denial of service protection and port restriction.

Encryption in transit. All hosted sites are served over TLS. Mail is sent and received over TLS wherever the other mail server supports it.

Architecture. Our web servers run PHP in an isolated process model rather than embedded in the web server, which limits what a compromise of one site can reach.

---

How we protect your devices and accounts

Endpoint protection. Bitdefender, set up and managed centrally by us across devices on our care plans rather than left to end users. It blocks threats automatically.

Updates. Our remote management platform applies software updates automatically. On every Care & Support plan, automatic updates are set to install critical Windows security updates within 14 days. This is an automated policy, not a guarantee: an update can fail or be held up, and on Light and Standard we won’t spot that unless you ask us. Premium includes a quarterly check. This covers Windows computers; servers and Macs are excluded.

Monitoring. The platform records device health, patch status and security events. On Care & Support Light and Standard, and on Business Server Care, support starts when you contact us, and we use these records when you ask for help. On Care & Support Premium we act on alerts proactively during office hours.

Remote access. Remote sessions to your computers normally go through Splashtop, the remote access tool built into our management platform, and every one of those connections is logged. Occasionally, for a one-off session on a computer without our management software, we connect through ISL Online using a session code you give us from our website chat; those sessions are not logged.

Wiping devices. When you return a computer to us to be wiped, we erase it with the manufacturer’s built-in method, following the NIST SP 800-88 standard: “Erase All Content and Settings” on modern Macs, which destroys the encryption keys, and “Reset this PC” with drive cleaning on Windows, which overwrites the drive. Business Windows PCs we manage have BitLocker drive encryption switched on as standard, and we monitor that it stays on. We record each wipe against the device in our service desk, and you receive a copy of the record.

Backup. Microsoft 365 data and hosted data are backed up to UK-based storage with Acronis. You choose how long your Microsoft 365 backups are kept; unless you tell us otherwise, we keep them with no time limit. Microsoft does not back up your data in the way most organisations assume, which is why this matters.

Security awareness training. Available through KnowBe4, including simulated phishing, because the most common route into a small organisation is a person rather than a system.

---

How we run our own house

Access control. Administrative access uses individual named accounts, never shared logins. Access is limited to people who need it, and reviewed when someone joins, changes role or leaves. Credentials for the systems we administer are held in a managed password vault.

Multi-factor authentication is enforced on our Microsoft 365 tenant and on administrative access to the platforms we manage, wherever the platform supports it.

Confidentiality. Everyone working for us is under a contractual duty of confidence that survives the end of their engagement.

Physical security. Our premises are protected by a monitored intruder alarm with police response. Customer devices left with us are held in a workshop area that is not accessible to the public, and any access credentials supplied with a device are kept on paper with it and destroyed once the work is done.

Monitoring and reporting. Our infrastructure runs automated daily health and security checks covering server performance, configuration drift, mail security and site availability. These are reviewed, and findings are acted on rather than filed.

Patching. Security updates are applied on a managed basis. Where a vendor patch is not yet available, we apply documented interim mitigations and record what we have done, so there is always a written position on any open issue.

---

When something goes wrong

We will tell you. If we become aware of a security incident affecting your data, we will notify you within 48 hours, with what we know, what we are doing and what you may need to do. Our contractual commitment to this is in our Data Processing Agreement.

We would rather tell you early and be wrong than tell you late and be right. Our notification is not an admission of fault; it is so you can make your own decisions in time.

We will be straight about what we don’t know. Early in an incident much is uncertain. We will say what is confirmed, what is suspected and what is still being established, rather than presenting a tidy account that turns out to be wrong.

---

Your part

Security is shared. The things that make the biggest difference at your end:

• Turn on multi-factor authentication everywhere it is offered, especially email.
• Do not reuse passwords. Use a password manager — we can supply one.
• Keep devices updated. Most successful attacks use a vulnerability that was patched months earlier.
• Tell us quickly if something looks wrong. An early report of a suspicious email costs us ten minutes. A late one can cost a great deal more.
• Make sure you have backup for anything you cannot afford to lose, and know how to get it back.

---

Reporting a vulnerability

If you believe you have found a security vulnerability in something we operate, please tell us at [email protected].

We will acknowledge your report within two working days, keep you updated, and will not pursue action against anyone who reports a genuine issue in good faith and does not access or alter data beyond what is necessary to demonstrate it.

---

Questions

If you need detail for a supplier assurance process, a security questionnaire or your own compliance work, contact us at [email protected]. We would rather answer properly than send a brochure.

---