Trust & security FAQ
Hosting and data residency
Where is customer data hosted?
All production data is hosted with Enhost (enhost.uk) on UK infrastructure. Enhost is our sole infrastructure sub-processor; their privacy policy lists the specific third-party tools they use to run their platform.
Can data be hosted in a specific country or region?
Data residency is single-region (UK) by default. We do not currently offer EU-only, US-only, or customer-specific region pinning. If your compliance regime requires data to remain in a specific jurisdiction, contact us before signing up so we can confirm fit.
Do you transfer personal data outside the UK?
Primary storage and processing stays in the UK. Where any sub-processor transfers data outside the UK or EEA, we rely on the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. See the Enhost privacy policy for the specific tools they use and where their data sits.
Encryption
Is data encrypted in transit?
Yes. All connections between clients and the service are TLS 1.2+; older protocols are disabled. The same applies to traffic between our application servers and our database, queue, and cache backends inside the Enhost network.
Is data encrypted at rest?
Sensitive fields (passwords hashed with bcrypt, MFA secrets, OAuth recovery codes, API token hashes, and any field that holds a credential) are encrypted at the database column level using Laravel's encrypted-cast machinery (AES-256). Wider disk-level encryption is provided by Enhost on the storage volumes that hold the database and file storage.
Do you have access to the contents of customer accounts?
Operationally we have the technical ability to read database rows for support and incident investigation, but we don't routinely browse customer data. All staff access is logged via the activity-log surface in the admin panel; impersonation events generate an audit row the customer can review on request.
Tenant isolation
How is one customer's data isolated from another's?
The platform is logically multi-tenant within a single database. Every customer-scoped
table carries a team_id foreign key and every query that returns customer data
scopes by it through the Filament tenancy layer. There's no shared-tenant fallback path;
an authorised user can only ever read rows their membership grants access to.
Are tenant subdomains routable into other tenants?
No. Subdomain → team binding happens once at request boot and is checked again at every controller / Filament page. Sessions are scoped by subdomain so a sign-in to one tenant doesn't leak into another.
Authentication and account security
What authentication methods do you support?
Email + password (with hashed-at-rest passwords), plus OAuth via Google, GitHub, and our Enhost ID provider. SAML SSO is not currently supported.
What MFA options are available?
TOTP (any authenticator app) and emailed one-time codes. Both can be enabled side-by-side with recovery codes. Customers can require MFA per-user from their profile.
What's the password policy?
Minimum 8 characters, enforced via Laravel's default password rules. Passwords are checked against the haveibeenpwned database at sign-up and password change. Passwords are stored as bcrypt hashes; we never log or store plaintext.
What's the session timeout?
Sessions expire after 2 hours of inactivity by default. "Remember me" extends the revocation horizon to five years but only after explicit opt-in at sign-in. Customers can terminate other sessions any time from the profile page.
Access control and staff access
Who at ANYMO SOLUTIONS LIMITED can access production data?
Production access is restricted to a small number of named engineers. Access is gated by OAuth-only sign-in to the admin panel (the email/password path is disabled there), plus MFA on the OAuth provider. There is no shared "admin" account; every action is attributed to a named individual.
How is access provisioned and deprovisioned?
Engineers gain production access by being added as Super Admin via the admin panel by an existing Super Admin. Deprovisioning is the reverse: the role is removed, the OAuth link is revoked, and any active sessions are invalidated.
Are admin actions logged?
Yes. Every state-changing action in the admin panel is recorded in the activity log (powered by spatie/laravel-activitylog), tied to the named actor and timestamped.
Backups and disaster recovery
How often are backups taken?
Database snapshots are taken nightly by Enhost with a 30-day retention window. Point-in-time recovery (PITR) is available for the previous seven days. Object storage (user uploads) is replicated within Enhost's storage layer.
What's the recovery time / recovery point objective?
Indicative RTO of 4 hours and RPO of 1 hour for a full restoration from the most recent backup. These are operational targets, not contractual guarantees; refer to the Terms of Service for the actual service-level commitments.
Are backups encrypted?
Yes. Backups inherit Enhost's at-rest encryption and are encrypted with a separate key from the live database.
Vulnerability management
Do you run penetration tests?
We don't currently commission scheduled third-party penetration tests. Researchers can report security issues through our responsible disclosure policy; we triage within 3 business days. When customer requirements justify it we'll move to a formal annual pen test.
How do you handle dependency vulnerabilities?
We run Composer's dependency audit on every CI build and weekly on the live branch. Critical and high-severity advisories trigger a patch release within 7 days; lower severities are batched into the next minor release.
Do you have a bug bounty?
Not at this stage. We thank researchers publicly on request once an issue is fixed.
Incident response
What's your breach notification timeline?
We notify affected Controllers without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting their data. See DPA §8 for the contractual commitment.
Do you have an incident response runbook?
Yes. Incidents are triaged by severity, assigned an incident commander, communicated to affected customers per the breach notification timeline, and followed by a written post-mortem.
Personnel and operational practices
Do staff sign confidentiality agreements?
All staff and contractors with access to customer data sign confidentiality undertakings as part of their engagement. The obligation survives termination of the relationship.
Do you run background checks?
For roles with production access, references are checked. Formal background checks are not currently universal but are planned as the team grows.
Is there security awareness training?
Engineers complete an internal security-practices walkthrough on onboarding and a refresh annually. Topics cover credential hygiene, phishing recognition, data-handling responsibilities, and the incident response process.
Compliance and certifications
Are you SOC 2 / ISO 27001 / Cyber Essentials certified?
We do not currently hold SOC 2, ISO 27001, or Cyber Essentials Plus certification. When a customer's procurement process requires one we'll communicate timing transparently rather than imply we have something we don't. The DPA we offer matches the substance of these certifications even without the certifying paperwork.
Are you UK GDPR compliant?
Yes. See the privacy policy and data protection page for the full statement of our obligations and your rights.
Sub-processors
Who are your sub-processors?
Our sole infrastructure sub-processor is Enhost (enhost.uk), which handles hosting, data storage, transactional email, SMS, and error reporting. Enhost is operated by the same company as VCurl but publishes its own privacy policy listing the specific third-party tools it relies on.
How are sub-processor changes communicated?
Material sub-processor additions or replacements are notified to the team's verified contact email at least 30 days before they take effect (see DPA §12). If you object, you can terminate before the change takes effect.
Data subject rights
How can my users exercise their GDPR rights?
Self-service: every user profile has a "Export your data" button (returns a ZIP of every record we hold for them) and a "Delete account" button (kicks off the 90-day recovery window, then permanent deletion). Other rights (restriction, objection, withdrawal of consent) are exercised via the profile or by emailing team@anymosolutions.uk. See /data-protection for the rights-at-a-glance summary.
How long do you retain customer data?
For as long as the account is active. After account closure or termination, data is held in a 90-day recovery window then permanently deleted. Backups containing the data are overwritten on a rolling 30-day cycle.
Getting a written DPA
A standard UK GDPR Article 28 DPA is available for every team, pre-filled with the team
name and effective date, at the team's own subdomain ({tenant}/dpa). The link
is surfaced in the team profile for the team's Owner and Admins.
Asking a question we haven't answered
If your security questionnaire asks something not covered above, email team@anymosolutions.uk. We aim to respond within 3 business days. If you need answers under NDA, send the NDA with the questionnaire and we'll counter-sign before responding.