CloudDespatch
Sign in Start free

Security policy

Last reviewed 26 October 2026

How CloudDespatch Ltd protects CloudDespatch and the data in it. This policy applies to all staff, contractors and systems that handle customer or buyer data. It is reviewed at least once a year and after any significant incident.
Contents
  1. Ownership and scope
  2. Access control and least privilege
  3. Multi-factor authentication
  4. Encryption
  5. Infrastructure and network
  6. Data retention and automatic deletion
  7. Vulnerability management
  8. Backups and recovery
  9. Incident response and breach reporting
  10. People and suppliers
  11. Responsible disclosure
  12. Review

1Ownership and scope

[Security lead name, role] owns this policy and reports on it to the directors every quarter. It covers the CloudDespatch application, its hosting, our office devices and our suppliers.

2Access control and least privilege

  • Staff get access only to the systems and data their role needs, approved by the security lead and recorded.
  • Production data access is limited to named engineers on support duty, and every access is logged.
  • Signing in as a customer to help them requires their request and is recorded against the staff member in the audit log.
  • Access is reviewed every quarter and removed on the day someone leaves or changes role.
  • Shared accounts are not allowed. Service credentials are kept in a secrets manager, never in code.

3Multi-factor authentication

  • Multi-factor authentication is mandatory for every staff member and administrator, on the CloudDespatch admin console, hosting, source code, email and payment systems.
  • Customers can require two-step sign-in for all their users, and it is always required for our Super Admin console.
  • Passwords are stored only as salted hashes using a modern algorithm [e.g. Argon2 or bcrypt].

4Encryption

  • In transit: all traffic uses TLS 1.2 or higher, with HTTPS enforced on every company web address.
  • At rest: databases, file storage and backups are encrypted with AES-256 by [hosting provider].
  • Courier and marketplace credentials are additionally encrypted at the application level.

5Infrastructure and network

  • Hosted with [hosting provider] in [hosting region].
  • The application runs as a dedicated non-root user with no shell access, inside a private network behind a firewall.
  • Only HTTPS is open to the internet. Databases accept connections only from the application.
  • Administrative access to servers goes through a bastion with multi-factor authentication and is logged.
  • Each company’s data is separated by tenant in every query, and this is covered by automated tests.

6Data retention and automatic deletion

  • Marketplace buyer details are deleted automatically 30 days after the order ships.
  • Security and access logs are deleted automatically after 12 months.
  • Closed accounts are deleted 90 days after closing, except records the law requires us to keep.
  • Deletion jobs run daily and their results are logged and checked every month.

7Vulnerability management

  • Automated vulnerability scans run every month across the application and infrastructure, plus dependency checks on every code change.
  • An independent penetration test is carried out every year, and after major changes. Findings are tracked to closure.
  • Critical fixes are applied within 7 days, high within 30 days.
  • All code changes are reviewed by a second engineer and pass automated tests before release.

8Backups and recovery

  • Databases are backed up continuously with point-in-time recovery, and snapshotted daily.
  • Backups are encrypted, stored separately from the live system and kept for 35 days.
  • A full restore is tested every quarter. Target recovery point: [1 hour]. Target recovery time: [4 hours].

9Incident response and breach reporting

  • Anyone who suspects a security incident reports it to the security lead immediately.
  • We contain, investigate and record every incident, with a written review afterwards.
  • If a personal data breach affects a customer, we tell them without undue delay and within 24 hours of becoming aware of it, with what we know and what we are doing.
  • Where we are the controller and the breach must be reported, we notify the ICO within 72 hours, and affected people where the risk is high.
  • Marketplaces are notified within the time their policies require.

10People and suppliers

  • Staff complete security and data protection training when they join and every year after.
  • Company laptops use full-disk encryption, automatic updates and screen locks.
  • Suppliers that handle customer data are assessed before use and bound by data protection terms.

11Responsible disclosure

If you think you’ve found a security problem in CloudDespatch, email security@clouddespatch.com with the details and steps to reproduce. We acknowledge reports within 2 working days and keep you updated until it’s fixed.

Please don’t access other companies’ data, disrupt the service or publish details before we’ve fixed the problem. We won’t take action against anyone who reports in good faith and follows these rules.

12Review

This policy was last reviewed on 26 October 2026 by [security lead name]. The next review is due by 26 October 2027.