Data Security Statement

Scope

The security page describes what protects hosted websites. This one is narrower: the personal data behind the accounts, and the technical and organisational measures Article 32 of the UK GDPR requires of us.

1. Encryption

All traffic to this site and the client area runs over TLS with HTTP Strict Transport Security set, so a browser will not silently downgrade. Certificates renew automatically.

Account passwords are salted and hashed and cannot be recovered by support or by anyone else here — a reset is the only mechanism, which is why nobody from this company will ask you for one. Card data never reaches our systems: the payment provider retains it and we hold a token plus the final four digits.

2. Access control

Access to systems holding personal data is granted against a named individual on the basis of need and withdrawn when the need ends. Administrative access requires two-factor authentication. Shared credentials are not used — an action that cannot be attributed cannot be accounted for.

Support sees your account, services and tickets. Reading file contents or database rows is not routine; where a request genuinely requires it, it happens with your knowledge and for that request only.

3. Isolation and resilience

Accounts sharing hardware are isolated from one another, so one site being breached does not become every site being breached. Platform software is patched, malware scanning runs continuously, and a web application firewall with network-level attack mitigation sits in front.

Daily copies are taken and are restorable without a ticket. They are a convenience rather than a warranty — the service level agreement is explicit that it settles on availability and never on data loss.

4. Location and sub-processors

Hosting infrastructure is in the United Kingdom. Personal data is processed in the UK and EEA; where a supplier operates elsewhere the transfer relies on the safeguards named in the privacy policy, which also lists the sub-processors.

Suppliers are assessed before adoption and bound by written terms no weaker than those we owe you. Where we act as your processor the data processing addendum applies.

5. Retention

Periods are set out in the privacy policy. In outline: account and billing records for the life of the account plus six years, as tax law requires; support tickets three years; server logs a matter of weeks.

On cancellation, data leaves live systems on the published schedule and then ages out of backups. Backups are not edited to satisfy an erasure request — editing a backup destroys its integrity — so they expire instead, with the data unavailable throughout.

6. Breach notification

A personal data breach likely to result in a risk to people is reported to the Information Commissioner's Office within 72 hours of us becoming aware. Where the risk is high, affected individuals are told directly and without undue delay.

Where we process on your behalf, you are notified without undue delay so that your own controller obligations can be met — your clock starts whether or not anyone has told you it has.

7. Vulnerability reporting

Report weaknesses to info@hostingally.com before disclosing elsewhere, allowing a reasonable remediation window. The same contact is published at /.well-known/security.txt.

Test against your own account only, do not access or modify others' data, and run no denial-of-service tests. Research within those bounds is welcome and will not be pursued.

8. Customer obligations

None of the above patches your extensions, selects your passwords or removes a departed contractor's credentials. Those sit in the acceptable use policy and account for most compromises observed here.

9. Contracting entity

HostingAlly operates as a trading name of Fairdeal Renovations Limited, a company registered in England and Wales under Company No. 15026869. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA. Security contact: info@hostingally.com.