We take security seriously - the consequences of getting it wrong simply aren't worth the risk. Whether you're a business, a charity or a public-sector body, you need to know your website and your data are in safe hands. Here's an outline of the practices we have in place, so you - and, where relevant, your board or trustees - can have real assurance.
Cyber Essentials
Nevitech holds Cyber Essentials, the UK government-backed certification overseen by the National Cyber Security Centre (NCSC). It independently confirms we have the five core technical controls in place - firewalls, secure configuration, user access control, malware protection and security update management - to protect against the most common cyber threats. For many public-sector and enterprise contracts it's a baseline requirement, so it's a useful shorthand that we meet a recognised standard.
The practices we have in place
Our devices are encrypted at rest.
All logins use strong passwords and two-factor authentication (2FA) wherever possible.
We run our devices under restricted user accounts, on a least-privilege basis.
We have endpoint protection (anti-virus / anti-malware) installed.
Our devices, servers and software are kept up to date.
The websites we host are isolated from one another and run under their own credentials.
Each website has separate test and live environments, kept isolated from one another.
Where applicable, hosted websites sit behind a web application firewall (WAF).
We take daily backups of our devices and servers.
We don't send personally identifiable information by email.
Our hosting and data reside in the UK, and we operate in line with UK GDPR.
Key providers we rely on (such as Microsoft Azure and Umbraco Cloud) hold their own certifications, including ISO 27001.
We use AI tools, but opt out of having our data used to train large language models.
Reviewing your website's security too
Looking after our own security is one thing; we can also review yours. Our Umbraco Security Review is an independent examination of your website's configuration, code and dependencies, with a prioritised, plain-English report of anything that needs attention.
Talk to us
Have a security question, or filling in a supplier questionnaire and need our details? Get in touch - we're happy to help.