Tèarainteachd.

• Encryption in transit (HTTPS/TLS, HSTS) and at rest.
• Each customer’s data is kept separate, with access rules enforced in the database.
• Staff access is limited to what’s needed and is logged.
• Payments are handled by a PCI DSS-compliant payment processor. Card numbers never touch our servers.
• Secrets are kept out of our code; dependencies are kept up to date.
• Rate limits and abuse monitoring protect the Service and your sites.

If you think you’ve found a security issue, please email info@neurahive.co.uk with details and steps to reproduce. Please don’t access or change other people’s data, disrupt the Service, or publicly disclose the issue until we’ve fixed it. We’ll acknowledge your report within 3 working days, keep you updated, and won’t take legal action against good-faith research that follows these rules.

If a security incident affects your personal data, we’ll tell you and the relevant regulators as the law requires, explain what happened and what we’re doing about it.