I-COSTSecurity & trust
Your prices stayyour prices.
Construction companies trust I-Cost with their estimates, supplier quotes, orders and people. Here is how we protect that data, what we follow, and how to report a security problem.
ISO/IEC 27001
What we follow.
We are aligning our information security with ISO/IEC 27001:2022: our policies, risk register and Statement of Applicability (all 93 Annex A controls) follow its structure. We are not certified. Read our security policies in brief; the full documents are available to customers on request: info@i-cost.co.uk.
Your data
Who can see what.
Separate workspaces
Every request is checked so a company can only reach its own projects, prices, documents and people. An automated test checks this for every page before each update goes live.
Roles and permissions
Your company admin decides what each role, and each person, can see and do, and which projects each person works on.
Private files
Orders, invoices, delivery notes, certificates, timesheet photos and drawings are checked when uploaded, kept in private storage and opened only by people signed in to your company.
Least access
Our team looks at customer data only when needed to support you or keep the service running.
Your copy, any time
Company admins can download all their company's data as a zip whenever they want.
Suppliers we use
The companies that process data for us are listed, with where and why, on our subprocessors page.
Signing in
A stolen password is not enough.
Strong passwords
At least 12 characters, stored only as one-way hashes. Sign-in pauses after 5 wrong passwords.
Two-step login
A code from a free authenticator app, or by email, as well as the password, with backup codes for a lost phone.
Security log
Admins see every sign-in and every change to people, permissions and settings: when, who and from where. Nobody can edit it.
Safe in the browser
HTTPS only. Sign-in cookies are never sent with forms from other websites, and I-Cost pages cannot be framed by other sites.
Hosting and backups
In the UK, copied every hour.
UK hosting
The application, database and files are hosted in the United Kingdom (Manchester), with a standby server in London.
Hourly backups
The database and new or changed files are copied off the server every hour to Cloudflare R2, encrypted at rest. Each company's records are also backed up daily.
Ready to take over
The London standby refreshes itself every night and can take over in about an hour. At most one hour of data could be lost.
Tested before every update
Every change runs our full automated test suite, including security checks, on the same software versions as the live service.
Kept up to date
Supported versions of Laravel and PHP. We follow NCSC alerts and patch critical issues within a day.
If something goes wrong
A written incident plan. If a breach affects your data we tell you without undue delay, and report to the ICO within 72 hours where the law requires.
Documents
For your security questionnaire.
- Our security policies in briefRead it
- Privacy noticeRead it
- Terms of serviceRead it
- Data processing addendumRead it
- SubprocessorsRead it
- Information security policyOn request
- Access control policyOn request
- Incident response planOn request
- Business continuity and disaster recoveryOn request
- Backup policyOn request
- Secure development policyOn request
- Supplier security policyOn request
- Statement of Applicability (ISO/IEC 27001 Annex A)On request
To ask for a document, or for help with a security questionnaire, email info@i-cost.co.uk.
Found something?
Report a security problem.
Email info@i-cost.co.uk with "Security" in the subject and enough detail for us to reproduce it. We acknowledge reports within 3 working days and keep you updated.
Please only test against your own account, do not access, change or delete other people's data, avoid anything that slows the service down, and give us reasonable time to fix the issue before telling anyone else. We will not take legal action against good-faith research that follows these rules.