Security

Report a security issue

If you think you've found a weakness in CreditorTrack UK, or that someone's data may have been exposed, tell us through our secure contact form and choose “A security problem or data concern”. You'll get a reference straight away, and we treat these reports as urgent.

Please describe what you found and how to reproduce it. Don't access, change or delete data that isn't yours, and give us reasonable time to fix the issue before telling anyone else.

How we protect your data

• Encrypted connections: every page and email link uses HTTPS, and our email is sent over an encrypted connection.
• Kept apart: each organisation's lists, labels, VAT numbers and messages are separate, and no other customer can see them. A reseller sees only the figures it needs to bill its clients, never their lists.
• Passwords and keys: passwords are stored only as secure hashes. Access tokens for the services we connect to are encrypted before they're stored.
• Limited staff access: access depends on role, and the administration area needs a code from an authenticator app as well as a password.
• Held in the UK: our servers and database are hosted in London.
• Payments: card details go straight to Stripe and never reach our servers.
• Tested: we check the service with security testing tools and fix what they find.

If something goes wrong

If a breach affects personal data, we'll contain it, tell the Information Commissioner's Office within 72 hours where the law requires it, tell anyone affected without undue delay, and tell any partner whose data or service is involved.

See our privacy notice for what we hold and why.