Compliance: what we commit to, and what we don’t
We make a security product, so this page only states what we can show is true. Where a rule doesn’t apply to us, we say so, and we say why.
- Met
Encrypted connection (HTTPS, HSTS)
Every page is served over an encrypted connection only, and browsers remember for a year not to try without it (HSTS). Pages go out with security headers: a content security policy (CSP), framing blocked, plus referrer and permissions policies.
- Met
Cookies and tracking (ePrivacy, PECR)
Google Analytics and the Meta pixel only load once you accept them in the cookie banner. Rejecting is as easy as accepting, and you can change your mind at any time. Before you consent, the page makes no requests to outside servers and sets no cookies.
- Met
Card data (PCI DSS)
We never see or store card details. Payments are handled by Stripe, certified at the highest level for card payments (PCI DSS Level 1).
- Met
Reporting a vulnerability (security.txt)
If you find a security issue on our site, the security.txt file tells you who to contact. It follows the RFC 9116 standard.
Open security.txt - Disclosure
Personal data (UK GDPR, EU GDPR)
Our privacy notice sets out what data we hold, why, for how long, who can access it and what your rights are. We only ask for what the service needs and delete it when the retention period ends. You can complain to the ICO in the UK or to your local data protection authority.
Privacy notice - Our benchmark
Accessibility (WCAG 2.1 AA)
We design and test every new page against WCAG 2.1 AA: enough contrast, full keyboard use, touch targets of at least 44 pixels, and animations that stop if you’ve turned motion off on your device. We haven’t had an independent accessibility audit yet, so we call it our benchmark rather than claim certified compliance.
- Doesn’t apply to us
NIS2 Directive
NIS2 covers medium and large organisations in essential and important sectors. As a small UK company, we don’t fall within it. Our check does, however, test from the outside some of the technical basics behind the risk-management measures in Article 21: encrypted connections, outdated software and known vulnerabilities, and email protection. That helps you prepare, but it isn’t a NIS2 compliance assessment.
- Doesn’t apply to us
Cyber Resilience Act (CRA)
The CRA covers products with digital elements placed on the market, such as software and devices. We provide an online service and don’t place products on the market.
- Doesn’t apply to us
Digital Services Act (DSA)
The DSA is mainly aimed at services that store and publish other people’s content. Our users don’t publish content to one another.
- Not held
ISO 27001
We don’t hold ISO 27001 certification, so we don’t claim it in any form.
Last checked: 25 October 2026.