Security

Cyber Essentials

Cyber Essentials is the UK government-backed scheme covering five technical controls that prevent the most common cyber attacks. We're working towards certification. We are not certified yet; below is how we approach each control today.

The five controls — and how we meet them

• Firewalls & boundary. A minimal exposed surface, with the control plane and mail-sending plane separated and reachable only over controlled paths.
• Secure configuration. Hardened services, no default credentials, secrets kept out of the code in access-restricted configuration, and only the ports the service needs open.
• User access control. Self-hosted authentication with scrypt password hashing, TOTP two-factor authentication, and scoped, revocable API keys.
• Malware protection. Slim container images with a controlled, audited dependency set.
• Security update management. Routine patching and dependency updates, with images rebuilt and redeployed regularly.

Status

Not yet certified — certification is in progress. The controls above describe our current practice, and we'll publish the certificate number here once it's issued.