Security

01. How this site is built

This website serves prebuilt pages. Enquiries are handled by a separate server function, hosted in London, that validates submissions and uses short-lived abuse-prevention data. Submitted information is handled as described in our Privacy policy.

The site serves its own fonts, images and scripts. Google Tag Manager and Google Analytics load only after you accept analytics. Advertising tags are blocked. On south.digital, its security headers restrict resources to the site and the specific providers it uses and stop other websites from framing its pages. There are no customer accounts, payment forms or public database interfaces on this website.

02. Platform security documentation

We use established hosting and website platforms. Each provider publishes documentation describing its own controls and, where available, independent reports. The scope varies by provider and service.

Using a platform does not make South Digital or a client website certified. We can help you find the relevant provider documentation for your procurement review.

03. Who holds your accounts

We set up the domain, hosting, repository and platform accounts for a build in your name wherever the platform allows, and work in them as invited collaborators. Anything we hold on your behalf is transferred to you at handover.

04. What this site keeps

This site remembers your colour theme and, when analytics is enabled, your analytics choice. The Cookie policy explains what is kept and how to remove it. Submitted information is handled as the Privacy policy describes. We take no payments through this website and never handle card data.

05. Reporting a security issue

If you believe you have found a security issue on this site or on a site we manage, email hello@south.digital. Reports are read by the people who can fix them, and we will respond as a priority.

Our reporting address is also available in the security.txt file linked below.