Information security policy

This policy belongs to Appoint Group Limited, a company registered in England and Wales under company number 16912796, with its registered office at 124-128 City Road, London EC1V 2NX. Questions about it, and reports of security concerns, go to hello@getappoint.co.uk.

What this policy is

This policy sets out how Appoint looks after the information it holds: its own information, information customers and prospective customers share with us, and the personal data of people who contact us. It applies to everyone who works for or with Appoint and to every system we use for the company's work.

We publish it so that customers, partners and visitors can see what we commit to. It describes what is in place today, not what we hope to have. Where we have not yet done something, we say so.

What we do not claim

We do not currently hold a security certification such as Cyber Essentials, ISO 27001 or SOC 2, and we do not claim one. If we gain one, we will say so on this page, with its scope and date.

This page does not describe how the Appoint product is built or secured. We give that information to customers and prospective customers directly, on request.

Our principles

1. Collect the minimum. We hold only the information we need, for the purpose we collected it, and no longer than we need it.
2. Need to know. Access to information is given to the people who need it for their work, and taken away when they no longer do.
3. One person, one account. Each person uses their own named account. Accounts are not shared, and we turn on multi-factor authentication wherever a service offers it.
4. Encrypt in transit. Information travelling between you and our systems is encrypted.
5. Established providers, written terms. We use established providers that publish their own security practices and their own data processing terms. Our privacy notice names the ones that handle personal data for us.
6. Keep software current. We build on a small set of maintained components and keep them up to date.
7. Record changes and incidents. Changes to our systems are recorded, with who made them and when. Incidents are recorded, reviewed and learned from.
8. Say what is true. We describe our security as it is.

This website

• The site at www.getappoint.co.uk is a set of static pages. It has no user accounts, no log-in and no forms, and it collects nothing itself. The "Register interest" and "Talk to us" links open your own email program.
• The site sets no cookies, runs no analytics or tracking, and loads nothing from other websites. Its typeface is served from the site itself.
• The site is hosted by Vercel Inc. in the United States. Vercel serves every site over an encrypted connection (HTTPS) and redirects plain HTTP requests to HTTPS, using TLS 1.2 or 1.3. Vercel publishes its own security information at security.vercel.com.
• The only data generated by a visit is the hosting provider's request log, which records the visitor's IP address, the page requested and browser details. Our privacy notice explains how that is handled.
• The site is built from source code held under version control, so every change is recorded with who made it and when. It depends on a small number of open-source components, which we keep up to date.

Email and documents

Email to getappoint.co.uk addresses is delivered to Google Workspace, and enquiries sent to us are held there. Vercel and Google each publish data processing terms that include the UK's safeguards for transferring personal data outside the UK.

If you need to send us sensitive documents, ask us first and we will agree a safe way to do it.

People

Everyone who works for or with Appoint must:

• use only their own named accounts, and never share passwords;
• turn on multi-factor authentication wherever a service offers it;
• keep any device used for Appoint's work locked when unattended, encrypted and up to date with security updates;
• handle information only for the purpose it was collected for, and only where their work needs it; and
• report any suspected security problem to the company straight away, even if they caused it.

When someone stops working with Appoint, their access is removed.

Personal data

Appoint Group Limited is registered with the UK data protection regulator, the ICO, as a fee payer under reference ZC099445. Article 32 of the UK GDPR requires us to put in place technical and organisational measures appropriate to the risk of our processing. This policy is part of those measures. Our privacy notice explains what personal data we hold and why.

If something goes wrong

If we discover or are told of a security incident, we will:

1. contain it, so that it cannot spread or recur;
2. find out what happened, what information was involved and who is affected;
3. record it, with what we did and when;
4. fix the cause, not only the symptom; and
5. tell the people who need to know.

Where an incident is a breach of personal data that is likely to put people at risk, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, as Article 33(1) of the UK GDPR requires. Where the breach is likely to put people at high risk, we will also tell the people affected without undue delay, as Article 34(1) requires. Where the data belongs to a customer, we will tell the customer without undue delay, as their agreement with us provides.

Reporting a security concern

If you have found a security problem with this website, with any system of ours or with how we handle information, please email hello@getappoint.co.uk with "Security" in the subject line. Tell us what you found, where, and how to reproduce it. We read every report and we will reply to you.

If you are testing our systems, we ask you to:

• not access, change or delete information that is not yours, and stop as soon as you have enough to show the problem;
• not disrupt our systems, for example by flooding them with requests;
• not target our people, for example with phishing or other social engineering;
• tell us straight away, and give us time to fix the problem before you tell anyone else. We will agree a timescale with you.

If you keep to these rules, we will treat your report as made in good faith and we will not take legal action against you for the research itself. We do not run a paid bug bounty programme.

Who is responsible, and review

The board of directors of Appoint Group Limited is responsible for this policy. It is reviewed at least once a year, and after any significant incident, and the date at the top of this page shows when it was last changed.