Security
Last updated 9 October 2026
Keeping customers' data safe is part of how iCost is built. This page summarises our main protections and how to report a security problem.
How we protect data
- UK hosting. The application, database and uploaded files are hosted in the United Kingdom.
- Encryption in transit. All connections use HTTPS.
- Separate workspaces. Every request is checked so a company can only reach its own projects, documents and people.
- Private documents. Uploaded purchase documents and photos are stored outside the public website and served only to the company they belong to.
- Sign-in protection. Passwords are stored as one-way hashes, repeated failed sign-ins are paused, and the sign-up form has a bot check.
- Least access. Our staff access customer data only when needed to provide support or keep the service running.
- Backups and retention. Rolling backups for recovery; data is deleted on the schedule in our Privacy Notice.
- Testing. We review our code and dependencies for vulnerabilities and fix them as a priority.
Reporting a vulnerability
If you think you have found a security problem in iCost, please email info@i-cost.co.uk with "Security" in the subject and enough detail for us to reproduce it. We will acknowledge your report within 3 working days and keep you updated.
Please: only test against your own account; do not access, change or delete other people's data; avoid anything that degrades the service (no denial-of-service or spam); and give us reasonable time to fix the issue before telling anyone else. We will not take legal action against good-faith research that follows these rules.