Security

We apply technical and organisational safeguards appropriate to the nature of the information we handle and the risks to it. Those safeguards are reviewed as our services develop.

Authenticated access with email verification and password reset, role-based permissions, and record-level access rules so that data is visible only to the organisation it belongs to.

Administrative access is separated from ordinary client access and is limited to personnel who require it.

Uploaded documents are held in private storage and served through time-limited signed links. BlueIxia never stores or requests third-party provider credentials.

Data is transmitted over encrypted connections, and stored data is held on infrastructure operated by established service providers under written terms.

Rate limiting on sensitive endpoints, administrative separation, audit logging of significant events, monitoring, and no credentials held in application code.

Security incidents are handled under an internal incident-management process, including assessment, containment, remediation and, where required, notification to affected parties and to the relevant supervisory authority.

Keep credentials confidential, do not share accounts, use up-to-date devices and browsers, and report anything that appears unusual.

No internet-connected system can be guaranteed to be absolutely secure. We do not describe our systems as unhackable, as completely secure, or by reference to marketing terms that cannot be objectively supported.

If you believe you have found a security issue, please contact us through the contact page with sufficient detail to reproduce it, and allow us a reasonable period to investigate and remediate before disclosing it publicly.

Please do not access, modify or delete data belonging to others, and do not carry out testing that could disrupt the service.