Security policies in brief

Last updated 4 November 2026

A short summary of each of our information security policies. They follow the structure of ISO/IEC 27001:2022; we are aligning with it and are not certified. The full documents, and our Statement of Applicability, are available to customers on request.

Information security policy

• Our objectives: each company sees only its own data; accounts are protected against password theft; customer files are never reachable without signing in; we can restore the service with at most one hour of data lost; problems are found, fixed and recorded quickly; every change is tested before it goes live.
• A named owner is responsible for information security, approves these policies and decides on risks. Policies are reviewed every year and after any major change or incident.
• Information is classed as Confidential (customer data, keys, backups, logs), Internal or Public, and handled to match.
• Encryption: HTTPS for every connection; passwords stored as one-way hashes; two-step login secrets encrypted; off-site backups encrypted at rest by our storage provider.
• Logging: a security log of sign-ins and changes (kept 3 months, cannot be changed in iCost) and application logs (kept 14 days).

Access control

• Least access and one person, one account: nobody shares an account, and every action can be traced to a person.
• In iCost, company admins decide what each role and person can do and which projects they work on; every request is checked so a company reaches only its own data.
• Passwords of at least 12 characters; sign-in paused after 5 wrong passwords; two-step login available to everyone; "keep me logged in" only after the two-step code.
• Our own staff use separate admin accounts, only when needed to support customers or run the service.
• Joiners get only the access their work needs; leavers lose all access on their last day and shared secrets they knew are changed. Access is reviewed every quarter.

Incident response

• Anyone can report a security problem to info@i-cost.co.uk (subject "Security"); we acknowledge within 3 working days.
• Every incident is recorded, rated by severity, contained, fixed and reviewed for lessons; evidence (logs, files) is kept.
• If a breach affects your data we tell you without undue delay, and report to the ICO within 72 hours where the law requires.

Business continuity and backups

• The database and new or changed files are copied off the server every hour; database copies are kept for 48 hours, then one a day for 30 days. Each company's records are also backed up daily and kept 14 days.
• A standby server in London refreshes itself every night and can take over in about an hour, with at most one hour of data lost.
• Only one server is live at a time, so data never splits between two copies.
• Backups are checked after every update and weekly; restore and switch-over tests are planned twice a year.

Secure development

• Development, testing and the live service are kept separate; customer data is never copied to development or test.
• Every change runs our full automated test suite, including security checks (company separation on every page, sign-in, file access), on the same software versions as the live service before it goes live.
• Before an update is saved, the live files are compared with the reviewed version; every update is recorded and can be rolled back.
• Secure coding rules: every record belongs to a company; input validated on the server; output escaped; uploaded files checked and kept private; no secrets in code.
• We follow NCSC alerts and patch critical issues within a day; third-party packages are checked for known vulnerabilities.

Suppliers

• Before a supplier handles customer data we check what they store, where, their security certifications and their data protection terms.
• The suppliers that process personal data for us are listed on our Subprocessors page, and reviewed every year.

Our people

• Staff and contractors sign confidentiality terms, read these policies when they join, and refresh them every year.
• Work devices that reach the service use disk encryption, a screen lock and up-to-date software.