For whoever has to fill in the security questionnaire

What a visitor requests

Every page is generated ahead of time and served as a static file from a content delivery network. There is no application server and no database in the request path, so a request cannot reach code that queries data, and there is no query to inject into.

• Static output, built from a version-controlled repository.
• No server-side rendering at request time, and no user session on the public site.
• Form submissions post to a separate, isolated endpoint that writes durably before any downstream call.

Tenancy and isolation

Platform services are multi-tenant with one deployment. Each site has an identifier, and access to a site’s data is enforced by infrastructure policy keyed on that identifier, beneath the application, so a mistake in code cannot return another client record.

• Credentials are issued per request, scoped to a single tenant, and expire in minutes.
• Console and assistant access are role-scoped, and the scope is checked at the point of use.

Change management and rollback

Every change is a version-controlled commit that passes a gate before publishing. Rollback targets the platform version rather than the deployment, so restoring a previous state rebuilds your current content against the earlier platform and never discards an edit made since.

• Gates cover accessibility, contrast, performance budgets, headers, links and structured data.
• A failed gate stops the publish and names what failed.

Sub-processors

Infrastructure sits with Amazon Web Services and Cloudflare, both in the United States. What each processes, and on what basis, is published on the trust pages and in your data processing agreement.

What you can show

• A completed security questionnaire, prepared on your behalf.
• A current sub-processor list with what each one does.
• A data processing agreement setting retention, breach notification terms and sub-processor change notice.