Last updated: December 2025

1. Introduction

Welcome to Outwizar. These Terms and Conditions ("Terms") govern your use of our website, mobile application, and services (collectively, the "Service"). By accessing or using our Service, you agree to be bound by these Terms. If you do not agree to these Terms, please do not use our Service.

Outwizar Limited ("we", "us", or "our") is a company registered in England and Wales. Our registered office is located in the United Kingdom.

2. Eligibility

You must be at least 18 years of age to use our Service. By using our Service, you represent and warrant that you are at least 18 years old and have the legal capacity to enter into these Terms.

3. Account Registration

To access certain features of our Service, you may be required to create an account. You agree to:

• Provide accurate, current, and complete information during registration
• Maintain and promptly update your account information
• Keep your password secure and confidential
• Accept responsibility for all activities that occur under your account
• Notify us immediately of any unauthorised use of your account

4. Subscription and Payments

Outwizar offers subscription-based services. By subscribing to our Service:

• You agree to pay the applicable subscription fees as displayed at the time of purchase
• Subscriptions automatically renew unless cancelled before the renewal date
• You may cancel your subscription at any time through your account settings
• Refunds are handled in accordance with our refund policy
• We reserve the right to modify pricing with reasonable notice

5. Use of the Service

Our Service provides personalised outfit recommendations based on your style preferences and budget. You agree not to:

• Use the Service for any unlawful purpose
• Attempt to gain unauthorised access to any part of the Service
• Interfere with or disrupt the Service or servers
• Copy, modify, or distribute our content without permission
• Use automated systems to access the Service without our consent

6. Intellectual Property

All content, features, and functionality of our Service, including but not limited to text, graphics, logos, icons, images, and software, are the exclusive property of Outwizar Limited or our licensors and are protected by copyright, trademark, and other intellectual property laws.

7. Third-Party Links and Products

Our Service may contain links to third-party websites and recommend products from third-party retailers. We are not responsible for the content, accuracy, or practices of these third parties. Any purchases you make from third-party retailers are subject to their terms and conditions.

8. Disclaimer of Warranties

Our Service is provided on an "as is" and "as available" basis. We make no warranties, expressed or implied, regarding the Service, including but not limited to merchantability, fitness for a particular purpose, or non-infringement. We do not guarantee that the Service will be uninterrupted, secure, or error-free.

9. Limitation of Liability

To the fullest extent permitted by law, Outwizar Limited shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or goodwill, arising out of or in connection with your use of the Service.

10. Indemnification

You agree to indemnify, defend, and hold harmless Outwizar Limited and its officers, directors, employees, and agents from any claims, damages, losses, liabilities, and expenses arising out of your use of the Service or violation of these Terms.

11. Termination

We may terminate or suspend your account and access to the Service immediately, without prior notice, for any reason, including if you breach these Terms. Upon termination, your right to use the Service will cease immediately.

12. Changes to These Terms

We reserve the right to modify these Terms at any time. We will notify you of any material changes by posting the new Terms on our website and updating the "Last updated" date. Your continued use of the Service after such changes constitutes your acceptance of the new Terms.

13. Governing Law

These Terms shall be governed by and construed in accordance with the laws of England and Wales, without regard to its conflict of law provisions. Any disputes arising under these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact Us

If you have any questions about these Terms, please contact us at:

• Email: [email protected]
• Company: Outwizar Limited
• Registered in: England & Wales

Last updated: December 2025

1. Introduction

Outwizar Limited ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Service").

We are registered in England and Wales and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect information that you provide directly to us, as well as information collected automatically when you use our Service:

2.1 Information You Provide

• Account Information: Name, email address, password, and profile details
• Style Preferences: Your fashion preferences, sizes, and style choices
• Budget Information: Your budget preferences for outfit recommendations
• Payment Information: Payment card details processed securely by our payment providers
• Communications: Information you provide when contacting our support team

2.2 Information Collected Automatically

• Device Information: Device type, operating system, and unique device identifiers
• Usage Data: Pages visited, features used, and time spent on the Service
• Location Data: General location based on IP address
• Cookies: Information collected through cookies and similar technologies

3. How We Use Your Information

We use your information for the following purposes:

• To provide and personalise our outfit recommendation service
• To process your subscription and payments
• To communicate with you about your account and our services
• To improve and develop our Service
• To send you marketing communications (with your consent)
• To detect, prevent, and address technical issues and fraud
• To comply with legal obligations

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract: Processing necessary to perform our contract with you
• Consent: Where you have given consent for specific processing activities
• Legitimate Interests: Processing necessary for our legitimate business interests
• Legal Obligation: Processing necessary to comply with legal requirements

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third parties who assist in operating our Service
• Payment Processors: To process your subscription payments securely
• Analytics Partners: To help us understand how our Service is used
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as necessary to provide our Service and fulfil the purposes described in this Privacy Policy. When you delete your account, we will delete or anonymise your personal data within 30 days, unless we are required to retain it for legal or regulatory purposes.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, secure servers, and regular security assessments.

8. Your Rights

Under UK data protection law, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Restriction: Request restriction of processing
• Portability: Request transfer of your data to another service
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, please contact us at [email protected].

9. International Transfers

Your personal data may be transferred to and processed in countries outside the UK. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office.

10. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on our website and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Data Protection Officer: [email protected]
• Company: Outwizar Limited
• Registered in: England & Wales

13. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk.

Last updated: December 2025

1. What Are Cookies?

Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work more efficiently and provide useful information to website owners.

Cookies help us remember your preferences, understand how you use our Service, and improve your overall experience.

2. How We Use Cookies

Outwizar uses cookies for the following purposes:

• Essential Functionality: To enable core features of our Service
• Authentication: To keep you signed in to your account
• Preferences: To remember your settings and preferences
• Analytics: To understand how visitors use our Service
• Performance: To improve the speed and performance of our Service

3. Types of Cookies We Use

4. Strictly Necessary Cookies

These cookies are essential for the operation of our Service. They include cookies that enable you to log into secure areas of our website and use account features. Without these cookies, services you have requested cannot be provided.

5. Functional Cookies

These cookies allow our Service to remember choices you make (such as your username, language, or the region you are in) and provide enhanced, more personalised features. They may also be used to provide services you have requested, such as watching a video or commenting on a blog.

6. Analytics Cookies

We use analytics cookies to understand how visitors interact with our Service. This helps us improve our website and provide a better user experience. We use the following analytics services:

• Google Analytics: Tracks page views, session duration, and user behaviour
• Hotjar: Provides heatmaps and session recordings to understand user interactions

Analytics data is collected anonymously and aggregated, meaning we cannot identify individual users from this data.

7. Third-Party Cookies

Some cookies are placed by third-party services that appear on our pages. We use the following third-party services:

• Stripe: Payment processing (essential for subscription services)
• Google: Analytics and authentication services
• Intercom: Customer support chat functionality

These third parties may set their own cookies on your device. We do not control the use of cookies by third parties. Please review their privacy policies for more information.

8. Managing Cookies

You can control and manage cookies in several ways:

8.1 Browser Settings

Most web browsers allow you to control cookies through their settings. You can:

• View and delete cookies stored on your device
• Block all cookies or only third-party cookies
• Set preferences for certain websites
• Enable "Do Not Track" settings

8.2 Browser-Specific Instructions

To manage cookies in your browser, please refer to the following guides:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

8.3 Cookie Consent

When you first visit our website, we display a cookie consent banner that allows you to accept or customise your cookie preferences. You can change your preferences at any time by clicking the "Cookie Settings" link in the footer of our website.

9. Impact of Disabling Cookies

If you choose to disable or block cookies, please be aware that:

• Some features of our Service may not work properly
• You may not be able to access certain areas of our website
• Your preferences will not be remembered between visits
• You may need to manually adjust settings each time you visit

10. Similar Technologies

In addition to cookies, we may also use similar technologies, including:

• Web Beacons: Small graphics used to track user activity
• Local Storage: Data stored locally in your browser
• Session Storage: Temporary data stored during your browsing session
• Fingerprinting: We do not use browser fingerprinting

11. Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in technology, legislation, or our data practices. When we make material changes, we will update the "Last updated" date at the top of this policy and notify you through our website.

12. Contact Us

If you have any questions about our use of cookies or this Cookie Policy, please contact us:

• Email: [email protected]
• Company: Outwizar Limited
• Registered in: England & Wales

13. More Information

For more information about cookies and how to manage them, you can visit:

• www.aboutcookies.org
• www.allaboutcookies.org
• ICO - Cookies Guidance

Your Data Protection Rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have several rights regarding your personal data. This page explains these rights and how to exercise them.

1. Right of Access (Subject Access Request)

You have the right to request a copy of the personal data we hold about you. This includes:

• Account information (name, email, profile details)
• Style preferences and budget settings
• Outfit recommendations history
• Transaction and billing information
• Communication records
• Usage data and analytics

2. Right to Rectification

You have the right to request that we correct any inaccurate personal data we hold about you. If your information is incomplete, you can also request that we complete it.

3. Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data in certain circumstances, including:

• When the data is no longer necessary for the purpose it was collected
• When you withdraw consent (where consent was the legal basis)
• When you object to processing and there are no overriding legitimate grounds
• When the data has been unlawfully processed

Note: Some data may need to be retained for legal, accounting, or fraud prevention purposes.

4. Right to Restriction of Processing

You can request that we restrict processing of your personal data in certain situations:

• While we verify the accuracy of your data
• If processing is unlawful but you don't want deletion
• If we no longer need the data but you need it for legal claims
• While we consider your objection to processing

5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request that we transfer this data directly to another service provider where technically feasible.

6. Right to Object

You have the right to object to processing of your personal data in certain circumstances:

• Processing based on legitimate interests or public interest
• Direct marketing (including profiling for direct marketing)
• Processing for research or statistical purposes

7. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. You can request human intervention, express your point of view, and contest the decision.

How to Submit a Data Request

You can submit a data request using any of the following methods:

Information Required

To process your request, please provide:

• Full name as registered on your account
• Email address associated with your Outwizar account
• Type of request (access, deletion, correction, etc.)
• Specific details about what data you're requesting or what action you want us to take
• Proof of identity (we may request additional verification)

Response Time

We will respond to your request within:

• One month for most requests
• Up to three months for complex or numerous requests (we will inform you if this applies)

We will acknowledge receipt of your request within 5 working days.

Fees

In most cases, we will process your request free of charge. However, we may charge a reasonable fee if your request is manifestly unfounded, excessive, or repetitive. We may also refuse to comply with such requests.

Identity Verification

To protect your privacy, we need to verify your identity before processing any data request. This helps ensure that personal data is not disclosed to unauthorised persons. We may ask you to provide additional information to confirm your identity.

Common Requests

Complaints

If you are not satisfied with how we handle your data request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Contact Us

For any questions about data requests or your privacy rights, please contact us:

• Email: [email protected]
• Company: Outwizar Limited
• Registered in: England & Wales

1. Our Commitment to Security

At Outwizar, security is at the heart of everything we do. We understand that you trust us with your personal information, style preferences, and payment details. That trust is something we take incredibly seriously, and we have implemented comprehensive security measures to ensure your data remains protected at all times.

2. Data Encryption

We employ industry-leading encryption standards to protect your data:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and our servers is encrypted using the latest TLS protocols, ensuring that your information cannot be intercepted during transit.
• AES-256 Encryption: Sensitive data stored in our databases is encrypted using Advanced Encryption Standard with 256-bit keys, the same standard used by financial institutions and government agencies.
• End-to-End Encryption: Payment information is processed through PCI DSS Level 1 compliant payment processors, ensuring your financial data never touches our servers in an unencrypted state.

3. Infrastructure Security

Our infrastructure is designed with security as a foundational principle:

• Cloud Security: We utilise enterprise-grade cloud infrastructure providers with ISO 27001 certification, ensuring physical and environmental security of our servers.
• Network Security: Multiple layers of firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) monitor and protect our network 24/7.
• DDoS Protection: Advanced distributed denial-of-service protection ensures our platform remains accessible even during attempted attacks.
• Regular Backups: Automated, encrypted backups are performed regularly and stored in geographically separate locations to ensure data resilience.

4. Access Controls

We implement strict access control measures to protect your data:

• Role-Based Access Control (RBAC): Employees only have access to the data necessary for their specific job functions.
• Multi-Factor Authentication (MFA): All internal systems require multi-factor authentication for access.
• Privileged Access Management: Access to sensitive systems is logged, monitored, and regularly audited.
• Principle of Least Privilege: We grant the minimum level of access required to perform any given task.

5. Application Security

Our application is built with security best practices:

• Secure Development Lifecycle (SDL): Security is integrated into every stage of our development process.
• Code Reviews: All code changes undergo peer review with a focus on security implications.
• Automated Security Testing: Continuous integration pipelines include static application security testing (SAST) and dynamic application security testing (DAST).
• Dependency Scanning: Third-party libraries are regularly scanned for known vulnerabilities.

6. Monitoring and Incident Response

We maintain vigilant monitoring and are prepared to respond to security incidents:

• 24/7 Security Monitoring: Our security operations centre monitors for suspicious activity around the clock.
• Security Information and Event Management (SIEM): Centralised log management and analysis helps us identify and respond to potential threats.
• Incident Response Plan: We maintain a comprehensive incident response plan that is regularly tested and updated.
• Breach Notification: In the unlikely event of a data breach, we will notify affected users and relevant authorities in accordance with UK GDPR requirements.

7. Compliance and Certifications

We adhere to recognised security standards and regulations:

• UK GDPR Compliance: We are fully compliant with the UK General Data Protection Regulation.
• Data Protection Act 2018: We comply with all requirements of the UK Data Protection Act.
• PCI DSS: Payment processing is handled through PCI DSS Level 1 compliant processors.
• Regular Audits: We undergo regular security audits and penetration testing by independent third parties.

8. Employee Security

Our team is trained and committed to security:

• Background Checks: All employees undergo background verification before joining.
• Security Training: Regular security awareness training is mandatory for all staff.
• Confidentiality Agreements: All employees sign confidentiality and data protection agreements.
• Security Culture: We foster a culture where security is everyone's responsibility.

9. Your Account Security

We also provide features to help you secure your account:

• Strong Password Requirements: We enforce minimum password complexity standards.
• Two-Factor Authentication: Optional 2FA adds an extra layer of protection to your account.
• Session Management: View and manage active sessions, and log out of all devices remotely.
• Login Notifications: Receive alerts when your account is accessed from a new device.

10. Contact Us

If you have any questions about our security practices or wish to report a security concern, please contact our security team:

• Security Team: [email protected]
• For vulnerability reports: Please see our Responsible Disclosure Policy

1. Introduction

At Outwizar, we take the security of our systems and our users' data extremely seriously. We value the security research community and welcome responsible disclosure of any vulnerabilities that may be found in our platform. This policy outlines how to report security vulnerabilities to us and what you can expect from us in return.

2. Our Commitment

When you report a vulnerability to us in accordance with this policy, we commit to:

• Acknowledgement: We will acknowledge receipt of your report within 48 hours.
• Communication: We will keep you informed about the progress of resolving the vulnerability.
• No Legal Action: We will not pursue legal action against researchers who follow this policy.
• Recognition: With your permission, we will publicly acknowledge your contribution once the vulnerability has been resolved.
• Timely Resolution: We will work diligently to resolve confirmed vulnerabilities as quickly as possible.

3. Scope

This policy applies to the following systems and services:

• The Outwizar website (www.outwizar.co.uk)
• The Outwizar mobile applications (iOS and Android)
• Outwizar APIs
• Any subdomains of outwizar.co.uk

Third-party services and applications are not in scope, even if they are integrated with Outwizar.

4. How to Report a Vulnerability

If you believe you have discovered a security vulnerability, please report it to us by:

• Email: Send your report to [email protected]
• Encryption: For sensitive reports, please use our PGP key (available upon request)

Please include the following information in your report:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• The potential impact of the vulnerability
• Any proof-of-concept code or screenshots
• Your contact information for follow-up
• Whether you wish to be publicly acknowledged

5. What We Ask of You

To ensure a safe and responsible disclosure process, we ask that you:

• Act in Good Faith: Make a genuine effort to avoid privacy violations, data destruction, and service disruption.
• Do Not Access User Data: Do not access, modify, or delete data belonging to other users.
• Stop Testing: Once you have confirmed a vulnerability exists, stop testing and report it immediately.
• Maintain Confidentiality: Do not disclose the vulnerability publicly until we have had reasonable time to address it.
• No Automated Scanning: Do not use automated vulnerability scanners that could impact service availability.
• No Social Engineering: Do not attempt to socially engineer our staff or users.
• No Physical Attacks: Do not attempt physical attacks on our offices or data centres.
• No Denial of Service: Do not intentionally degrade or disrupt our services.

6. Qualifying Vulnerabilities

We are particularly interested in vulnerabilities such as:

• Remote code execution
• SQL injection
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• Authentication and authorisation flaws
• Sensitive data exposure
• Server-side request forgery (SSRF)
• Insecure direct object references
• Business logic vulnerabilities

7. Out of Scope

The following issues are generally considered out of scope:

• Vulnerabilities in third-party services or applications
• Social engineering attacks
• Physical security issues
• Denial of service attacks
• Spam or social engineering techniques
• Missing security headers that do not lead to direct exploitation
• Clickjacking on pages with no sensitive actions
• Self-XSS (where user action is required to trigger)
• Issues related to password complexity requirements
• Rate limiting or brute force issues on non-authentication endpoints
• Disclosure of software versions
• Theoretical vulnerabilities without proof of concept

8. Disclosure Timeline

We aim to follow this general timeline:

• Day 0: You submit your vulnerability report
• Within 48 hours: We acknowledge receipt of your report
• Within 7 days: We provide an initial assessment of the vulnerability
• Within 90 days: We aim to resolve the vulnerability (complex issues may take longer)
• After resolution: We may publicly disclose the vulnerability with your agreement

We ask that you do not disclose the vulnerability publicly until we have had reasonable time to address it, typically 90 days from the initial report.

9. Recognition

We appreciate the efforts of security researchers who help us keep Outwizar secure. With your permission, we will acknowledge your contribution in our security hall of fame. We may also consider monetary rewards for particularly significant vulnerabilities, at our discretion.

10. Legal Safe Harbour

If you conduct your security research in accordance with this policy, we consider your research to be authorised, and we will not initiate or support legal action against you. If legal action is initiated by a third party against you for activities that were conducted in accordance with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

11. Contact

For any questions about this policy or to report a security vulnerability, please contact:

• Security Team: [email protected]
• PGP Key: Available upon request

1. Secure Development Lifecycle

Security is embedded into every phase of our software development process:

• Security Requirements: Security requirements are defined at the outset of every project, ensuring that security considerations are built into the design from day one.
• Threat Modelling: We conduct comprehensive threat modelling exercises to identify potential security risks before any code is written.
• Secure Coding Standards: Our developers follow industry-recognised secure coding guidelines, including OWASP secure coding practices.
• Security Champions: Each development team includes a dedicated security champion who ensures security best practices are followed throughout the development cycle.

2. Code Security

We employ rigorous code security measures to ensure the integrity of our application:

• Peer Code Reviews: All code changes undergo mandatory peer review with a specific focus on security implications before being merged.
• Static Application Security Testing (SAST): Automated tools analyse our source code for potential security vulnerabilities during the development process.
• Dynamic Application Security Testing (DAST): Our running applications are continuously tested for vulnerabilities using automated scanning tools.
• Software Composition Analysis (SCA): Third-party libraries and dependencies are regularly scanned for known vulnerabilities and updated promptly.

3. OWASP Top 10 Protection

We implement comprehensive protections against the OWASP Top 10 security risks:

• Injection Prevention: Parameterised queries and input validation prevent SQL injection, command injection, and other injection attacks.
• Broken Authentication Protection: Strong session management, secure password storage using bcrypt, and multi-factor authentication protect user accounts.
• Sensitive Data Protection: All sensitive data is encrypted at rest and in transit using industry-standard encryption algorithms.
• XML External Entity (XXE) Prevention: XML parsers are configured to disable external entity processing.
• Access Control: Role-based access control (RBAC) ensures users can only access resources they are authorised to view.
• Security Misconfiguration Prevention: Automated configuration management ensures consistent and secure deployments.
• Cross-Site Scripting (XSS) Prevention: Output encoding, Content Security Policy (CSP), and input sanitisation protect against XSS attacks.
• Insecure Deserialisation Prevention: We validate and sanitise all serialised data before processing.
• Component Vulnerability Management: Regular dependency updates and vulnerability scanning keep our components secure.
• Logging and Monitoring: Comprehensive security logging enables rapid detection and response to potential threats.

4. API Security

Our APIs are designed with security as a priority:

• Authentication: All API endpoints require proper authentication using industry-standard protocols such as OAuth 2.0 and JWT tokens.
• Rate Limiting: API rate limiting prevents abuse and protects against denial-of-service attacks.
• Input Validation: Strict input validation ensures that only properly formatted data is accepted.
• API Versioning: Proper versioning allows us to deprecate insecure endpoints whilst maintaining backward compatibility.
• API Documentation: Clear documentation helps developers use our APIs securely and correctly.

5. Mobile Application Security

Our mobile applications incorporate robust security measures:

• Secure Data Storage: Sensitive data is stored using platform-specific secure storage mechanisms (Keychain on iOS, Keystore on Android).
• Certificate Pinning: SSL certificate pinning prevents man-in-the-middle attacks.
• Code Obfuscation: Application code is obfuscated to make reverse engineering more difficult.
• Biometric Authentication: Support for fingerprint and facial recognition provides convenient yet secure authentication.
• Jailbreak/Root Detection: The application detects compromised devices and can limit functionality accordingly.

6. Session Management

We implement secure session management practices:

• Secure Session Tokens: Session tokens are cryptographically random and sufficiently long to prevent guessing.
• Session Timeout: Sessions automatically expire after a period of inactivity to reduce the window of opportunity for session hijacking.
• Session Invalidation: Sessions are properly invalidated on logout and password change.
• Concurrent Session Control: Users can view and terminate active sessions from any device.

7. Security Testing

Regular security testing ensures our applications remain secure:

• Penetration Testing: We engage independent security firms to conduct regular penetration tests of our applications.
• Vulnerability Assessments: Regular vulnerability scans identify potential weaknesses before they can be exploited.
• Red Team Exercises: Simulated attacks help us understand and improve our security posture.
• Bug Bounty Programme: Our responsible disclosure programme encourages security researchers to report vulnerabilities.

8. Secure Deployment

Our deployment processes incorporate security best practices:

• Infrastructure as Code: Reproducible, version-controlled infrastructure ensures consistent security configurations.
• Immutable Infrastructure: Servers are replaced rather than modified, reducing configuration drift and potential vulnerabilities.
• Secrets Management: Sensitive credentials are stored in secure vaults and never hardcoded in source code.
• Container Security: Container images are scanned for vulnerabilities and signed to ensure integrity.

9. Incident Response

We are prepared to respond quickly to security incidents:

• Security Monitoring: Real-time monitoring detects suspicious activity and potential security breaches.
• Incident Response Team: A dedicated team is on standby to respond to security incidents 24/7.
• Documented Procedures: Clear, tested procedures ensure efficient and effective incident response.
• Post-Incident Review: Every security incident is thoroughly analysed to prevent recurrence.

10. Continuous Improvement

We are committed to continuously improving our security posture:

• Security Training: All developers receive regular security training to stay current with emerging threats and best practices.
• Threat Intelligence: We monitor threat intelligence feeds to stay informed about new vulnerabilities and attack techniques.
• Security Metrics: Key security metrics are tracked and reported to ensure continuous improvement.
• Regular Reviews: Security policies and practices are reviewed and updated regularly.

11. Contact Us

If you have any questions about our application security practices or wish to report a security vulnerability, please contact us:

• Security Team: [email protected]
• For vulnerability reports: Please see our Responsible Disclosure Policy
• General security enquiries: Visit our Security Overview