Security & Trust
PSIP is built for organisations that take procurement — and data protection — seriously. This page explains how we protect your data, where it is held, how we stay compliant, and how to report a security issue.
How we protect your data
Encryption in transit and at rest
All traffic to PSIP is served exclusively over HTTPS (TLS). Data stored in our database and file storage is encrypted at rest using AES-256.
Authentication and access
Authentication is handled by a dedicated identity provider with securely hashed credentials and signed, expiring session tokens. Multi-factor authentication (MFA) is available on all accounts and enforced for administrative access; users who enable it are challenged at every sign-in.
Account data isolation
Every request is scoped to the authenticated account at the database layer using row-level security, so one customer can never read another customer’s data.
Backups and resilience
Our database is backed up automatically every day, so data can be restored in the event of a failure. Infrastructure runs on managed, redundant cloud platforms.
Monitoring and audit trail
We run continuous error and uptime monitoring and automated pipeline health checks. Security-sensitive and administrative actions are recorded in a tamper-evident, append-only audit log.
Secure development
Changes pass automated checks before release, dependencies are monitored for known vulnerabilities, and secrets are managed outside the codebase and never committed to source control.
Data residency & sub-processors
Customer data is hosted within the European Union (Ireland / eu-west-1) on established managed cloud infrastructure. We do not sell customer data, and we use a small, vetted set of sub-processors to run the service.
A full list of our sub-processors — with their purpose, location, and the safeguards applied to any data transfers — is published in our Privacy Policy.
Compliance & certifications
UK GDPR & Data Protection Act 2018
We process personal data in line with UK data protection law, with defined lawful bases, retention periods, and data-subject rights set out in our Privacy Policy.
Registered with the ICO
PSIP is registered with the UK Information Commissioner’s Office (registration ZC123196).
Responsible disclosure programme
We operate a published vulnerability disclosure policy with a dedicated security contact and safe-harbour commitments (see below).
Cyber Essentials
We are working towards Cyber Essentials certification, the UK government-backed baseline for cyber security controls.
Independent penetration testing
We are engaging an independent third party to conduct penetration testing of the platform.
Responsible disclosure
We welcome reports from security researchers who identify vulnerabilities in good faith and will work with you to resolve them quickly.
Found a vulnerability?
Email us at [email protected]. We will acknowledge your report within 2 business days and aim to provide a full response within 10 business days.
Report a vulnerabilityScope
In scope
- ▸psip.co.uk and all subdomains
- ▸The PSIP web application and API
- ▸Authentication and session management
- ▸Data isolation between user accounts
Out of scope
- ▸Denial of service attacks
- ▸Social engineering of PSIP staff
- ▸Physical security
- ▸Third-party services (Supabase, Resend — report these to those providers directly)
How to report
Email [email protected]
Send your report to our dedicated security address. Please do not report vulnerabilities through public GitHub issues, social media, or other public channels.
Include the key details
A clear description of the issue, step-by-step instructions to reproduce it, an assessment of the potential impact, and your contact details for follow-up.
Allow us time to respond
We will acknowledge your report within 2 business days. We aim to provide a full response — including our assessment and a fix timeline — within 10 business days.
Our commitments to researchers
No legal action for good faith research
We will not pursue legal action against researchers who discover and report vulnerabilities responsibly, in accordance with this policy.
We will keep you informed
We will update you as we investigate and resolve the issue. We aim to be transparent about our timelines and findings.
Credit where it is due
We will acknowledge researchers in our release notes for confirmed vulnerabilities, where the researcher chooses to be named.
What we ask of you
- ▸Do not access, modify, or delete other users' data
- ▸Do not disrupt the service or degrade its performance for other users
- ▸Report to us before making any public disclosure, and allow reasonable time for a fix
- ▸Act in good faith — test only against your own account where possible
Security contact
For all security-related reports and enquiries:
[email protected]Response within 2 business days · Full response within 10 business days