Security at Converant

We are a small studio, so our security model is built on simple, enforced defaults: keep less data, restrict who can reach it, verify anything that affects money or access on the server, and use managed platforms rather than hand-rolled infrastructure.

• All traffic to this site and its portal is served over HTTPS/TLS.
• Data stored by our managed database and file storage is encrypted at rest by the platform.
• Credentials and API keys are held as encrypted server-side secrets, never in frontend code.

• Client portal access requires an authenticated account.
• Database access is governed by row-level rules, so an account can only read its own records.
• Administrative capability is granted by an explicit, separately stored role and checked on the server for every privileged action.
• Internal notes and pricing controls are available to studio administrators only.
• Access is granted on a least-privilege basis and removed when no longer needed.

• All input is validated against a schema on the server, not only in the browser.
• Privileged operations run server-side; the browser cannot set prices or roles.
• Dependencies are kept current and reviewed when vulnerabilities are reported.
• Changes are reviewed before release and can be rolled back.

The site runs on managed hosting with platform-level network protection. Application errors and failed operations are logged so problems are noticed and investigated. We do not publish our infrastructure topology, addresses or configuration.

Our managed database platform maintains backups, and application code is version controlled so a release can be restored.

Backup frequency, retention and tested recovery objectives: [TO CONFIRM — backup schedule, retention window and last restore test].

We collect what a project actually needs. We do not ask for card details, identity documents or special-category information, and we ask clients not to send them to us.

Card payments are handled by Stripe. Card data is entered into Stripe's own interface and never reaches our servers. Amounts charged are read from our server-side record for the project — a value supplied by the browser can never determine what is charged. Payment outcomes are confirmed through signed webhook events.

If we become aware of a security incident affecting personal information, we investigate immediately, contain it, and assess whether it must be reported. Where a personal-data breach is likely to result in a risk to people's rights, we notify the ICO within 72 hours of becoming aware, and we tell affected people where the risk is high. Where we act as a processor for a client, we notify that client without undue delay.

We use established providers for hosting, database and authentication, transactional email and payments, and rely on their platform-level security controls alongside our own.

• Supabase — processor.
• Stripe — processor and/or independent controller, depending on the activity.
• HubSpot — processor.
• Resend — processor.
• Vercel — processor.
• Calendly — processor and/or independent controller, depending on the activity.
• Virtual private server hosting — processor.

We rely on these providers' platform-level controls alongside our own. Their certifications belong to them and are not certifications held by Converant. Full detail on roles and data locations is in the privacy notice.

We do not publish hostnames, addresses, ports, paths, secret names or internal network architecture for the servers we operate. Our hosting provider and its data location are still to be confirmed before being named: [TO CONFIRM — VPS provider and data location].

If you believe you have found a vulnerability in this site or in a site we maintain, please tell us before disclosing it publicly. Email hello@converant.co.uk with the affected URL, what you observed and how to reproduce it.

Please do not access, modify or delete data belonging to others, degrade the service, or run intrusive automated scanning. We will acknowledge your report and keep you updated. Acknowledgement target: [TO CONFIRM — disclosure acknowledgement timeframe]. We do not currently operate a paid bug-bounty programme.

We hold no independent security certification and make no claim to be ISO certified, SOC 2 audited, "fully GDPR compliant" or fully secure. No system can be. What we can say is on this page, and we will update it as our controls are formalised and verified.