Security

What we actually do to protect your account and your company's records.

• No passwords to steal. You sign in with a one-time code sent to your email. Codes are stored only as a hash and expire after 5 minutes; repeated attempts are blocked.
• Every request is checked by the server. Membership and role are checked on every request, for the company named in that request. The app's screens are never trusted to decide what someone may see.
• Company separation. Every record belongs to one company and the server refuses access from any other company, including for files.
• Roles. Workers never receive budgets, costs or invoices.
• Records that can't be quietly changed. Issued invoices are sealed by the server.
• Encrypted in transit. The app and websites only talk over HTTPS. Files are kept in private storage with no public links.
• Minimal data. No advertising or analytics tools.

What we don't claim

SiteFeed Teams has not been certified to any security standard (such as ISO 27001 or Cyber Essentials) and has not yet had an independent security review. We will say so here when that changes.

Report a problem

If you think you have found a security problem, please email support@sitefeed.co.uk with the details and don't access other people's data. Please include the steps to reproduce it.