Security and data handling
Security and data handling
This page describes how we protect data on this website and in our contact and recruitment systems. Security documentation for the Bletchley product is available on request at contact@bletchleyint.com.
Hosting and network
- All traffic uses HTTPS, and browsers are told to insist on it (HSTS).
- The website is hosted on Vercel, and its server functions run in the European Union (Frankfurt).
- The site loads no third-party scripts, advertising or tracking. Security headers, including a strict Content-Security-Policy, limit what a page can load or do.
Access control
- Our internal recruitment tools require an individual account for each team member. Passwords are stored only as salted hashes.
- Sessions expire after eight hours, and repeated failed sign-ins from one address are blocked temporarily.
- Candidate CVs are stored in a private bucket. Downloading a CV, or sending an email to a candidate from our tools, requires a signed-in team member.
- The database accepts requests only from our server, not directly from browsers.
Data minimization and retention
We collect only what we need for the purposes in our Privacy policy and keep it for the periods listed there: contact abuse logs for 90 days, enquiries and applications for 24 months. A deletion request is handled by removing the record and any stored CV.
Protection against abuse
The contact form uses a security question, a hidden trap field, rate limits and duplicate detection to stop automated spam without tracking visitors.
How Bletchley uses automation
The Bletchley product automates the retrieval and structuring of company information from official registries into a draft scope report. Automation prepares; professionals decide. Analysts review, verify and sign off the result. This website does not make automated decisions about people.
Service providers
| Provider | Used for |
|---|---|
| Vercel Inc. | Website hosting and cookieless analytics |
| Supabase | Database and private file storage for enquiries and recruitment |
| Resend | Delivery of notification and candidate emails |
| Microsoft | Email, calendar and the demo booking page |
Reporting a vulnerability
If you believe you have found a security issue, email contact@bletchleyint.com with the subject "Security". Please describe the issue, avoid accessing other people's data, and give us reasonable time to fix it before you disclose it. We welcome good-faith research that follows these guidelines. Our security.txt file lists the same contact.