Legal

Security & Disclosure Policy

Last updated October 2026

Security Measures

We take the security of our website and client data seriously. Measures include:

  • SSL/TLS encryption on all pages
  • Secure, regularly updated infrastructure
  • Access controls and authentication
  • Regular security reviews

How This Website Is Protected

  • Encrypted connections only. Every page is served over HTTPS, and browsers are told to refuse plain HTTP for this site (HSTS).
  • Hosting and network. The site runs on Cloudflare's network, which filters automated attacks and absorbs denial-of-service traffic before it reaches us.
  • Browser protections. Pages are sent with headers that stop content-type sniffing, limit referrer information and switch off camera, microphone and location access.
  • Email you can trust. Mail from @dhwebsiteservices.co.uk is signed (DKIM), our sending servers are published (SPF), and our DMARC policy tells receiving mail servers to reject anything that fails those checks, so it is hard for anyone to send email pretending to be us.

Client Projects and Data

  • Card payments are handled by our payment provider. We never see or store full card numbers.
  • Access to client systems, hosting and app store accounts is limited to the people working on the project.
  • When a project ends, the code, accounts and credentials are handed over to you.

Security Contact File

Our contact details for security reports are also published in the standard machine-readable format at /.well-known/security.txt.

Responsible Disclosure

If you discover a security vulnerability in our website or services, we ask that you:

  1. Do not exploit the vulnerability or access data you are not authorised to access
  2. Report it to us promptly at [email protected]
  3. Give us reasonable time to investigate and remediate before any public disclosure
  4. Include details such as steps to reproduce, impact, and any relevant screenshots

What We Promise

  • We will acknowledge your report within 3 business days
  • We will investigate and keep you informed of progress
  • We will not take legal action against researchers acting in good faith

Contact

Security reports: [email protected]

Other policies

Questions about any of these? Email [email protected] or ring 01443 805303. DH Website Services is a trading name of David Hooper Home Limited, registered in England and Wales, company number 17018784. Registered office: 36b Coedpenmaen Road, Trallwn, Pontypridd CF37 4LP.