Data Security Statement

What this covers

This is not the marketing version of security, nor is it about what defends your website. The subject is the personal data sitting behind the accounts, plus the measures Article 32 of the UK GDPR expects from us. Paying little for hosting does not buy a lower standard here. It buys the same standard, purchased efficiently.

1. Encryption

Every page here and every screen in the client area moves over TLS, and HTTP Strict Transport Security is set so no browser drops back to an unencrypted connection without saying anything. Renewal of certificates happens on its own.

Salting and hashing is how passwords get stored, which means support cannot read yours back, and no one else here can either. Resetting is the only way through, and that is precisely why nobody from this company will ever ask you for a password. Card numbers never touch our systems at all: the payment provider keeps them, while we hold a token and the last four digits.

2. Who can see what

A named person gets access to systems holding personal data where there is a need for it, and that access is withdrawn once the need has gone. Two-factor authentication is required for administrative access. Shared logins are not used by anyone, since an action that cannot be tied to a person is an action nobody answers for.

Your account, your services and your tickets are visible to support. Going through your files or your database is not routine work, and on the rare request that genuinely calls for it, you know it is happening and it covers that request alone.

3. Keeping accounts apart

Where accounts share a machine, walls stand between them, so a break-in at one site does not become a break-in at all of them. We patch the platform software, malware scanning runs without pause, and out in front sits a web application firewall with network-level attack mitigation.

A copy is taken each day, and restoring it is something you can do yourself. Treat it as a convenience, not a guarantee: the service level agreement states in plain terms that it pays out on availability alone, and never on lost data.

4. Where the data sits, and who else handles it

The hosting infrastructure stands in the United Kingdom. Personal data gets handled inside the UK and the EEA, and if a supplier operates somewhere beyond that, the transfer leans on the safeguards named in the privacy policy, which also names each of those suppliers. Every one of them is checked before we take them on, and they are bound by written terms no weaker than the terms we owe you.

5. How long the records last

Full periods are in the privacy policy. Broadly speaking: account and billing records last as long as the account plus six years, since tax law demands it; support tickets go three years; raw server logs survive for a matter of weeks.

Cancel a service and its data comes off live systems on the published schedule, then ages out of the backups. Nobody here goes into a backup with a scalpel to satisfy a deletion request, because taking a knife to it destroys the very property that makes it a backup. Backups are left to expire on their own, and the data stays unavailable while that happens.

6. If something goes wrong

Any personal data breach that looks likely to put people at risk reaches the Information Commissioner's Office within 72 hours of the moment we find out. Should the risk to people be high, word reaches them from us straight away.

If the data belongs to you and our role is only to process it, word comes to you without undue delay, since your own 72-hour clock begins running whether or not anybody has mentioned it.

We would sooner tell you about a scare that comes to nothing than hold something back while somebody works out how it might look to everyone else.

7. Reporting a weakness you spotted

Found a hole? info@hosting-cheap.com, ahead of anywhere else, and allow us a reasonable window in which to fix it. That same contact appears in machine-readable form at /.well-known/security.txt.

Test against your own account only, keep away from other people's data, and do not flood anything. Stay within those lines and you have our word that looking will bring no legal consequences.

8. The part that falls to you

Not one bit of this updates your plugins, chooses your passwords, or gets rid of the freelancer still holding your FTP details. Those belong in the acceptable use policy, and those are the things behind most of the compromises we actually see.

9. The company

Hosting-Cheap is a trading name owned by Bohzo Ltd, a company registered in England and Wales under Company No. 15031604. Registered office: The Workspace Basildon, 7 High Pavement, Basildon, England, SS14 1EA. Security contact: info@hosting-cheap.com.