1. Security approach
Paulioskos uses a risk-based, engineering-led approach to security. Controls are selected according to the information, service, threat, client commitment and operational consequence involved. Security is treated as an ongoing responsibility rather than a one-off configuration exercise.
The current platform is an early-stage business service. This statement distinguishes implemented controls from planned maturity work and does not claim guaranteed security, external certification or a staffed security operations centre.
2. Identity and access
Administrative access uses individually assigned Microsoft Entra identities; shared administrator identities are prohibited.
Multi-factor authentication is required for authorised administrators.
Access to the enquiry console is role-based and granted only for a documented business need.
The website mailer uses a separate application identity with restricted mailbox access.
Local production password login is disabled during normal operation.
Privileged access and assigned roles are subject to periodic review and removal when no longer required.
3. Restricted administration and network security
Public website traffic is delivered through Cloudflare and HTTPS.
Privileged management services are separated from ordinary public access and are reached through a restricted management route.
Only necessary public web services are intended to be exposed.
Cloudflare provides DNS, reverse proxy and edge-security filtering.
Production secrets, database content, backup information and management configuration are treated as confidential security assets.
Detailed firewall rules, private addresses, administrative endpoints and recovery locations are not published because doing so would increase security risk.
4. Application and data controls
The public enquiry form uses server-side validation, length limits, sanitisation, anti-automation controls and rate limiting.
Database access is mediated through the application and parameterised queries are used for user-controlled values.
Administrator sessions are stored server-side and use a Secure, HttpOnly, SameSite cookie with a maximum rolling lifetime of eight hours.
Authenticated administrative responses use no-store caching controls.
Production source, runtime data and secrets are separated; secrets and live database data are excluded from Git.
The production deployment key is restricted to the access needed for deployment.
5. Encryption
Information is encrypted in transit using HTTPS and secure provider connections. Microsoft 365 provides provider-managed encryption at rest for in-scope cloud content. Paulioskos has not implemented a customer-managed encryption-key system for Microsoft 365.
Encryption of every self-hosted disk and backup repository has not yet been independently evidenced. Paulioskos therefore does not make a blanket claim that every stored copy is encrypted at rest. Formal evidence of endpoint, host and backup encryption is part of the continuing control programme.
6. Secure development and change control
Develop and test changes in a separate working environment.
Review the intended Git changes and exclude secrets, runtime databases and uncontrolled evidence.
Run syntax, dependency, functional and security-relevant checks.
Create a descriptive version-control commit.
Confirm backup status and create a verified pre-change database and configuration copy for material releases.
Deploy through the controlled source-to-runtime process.
Perform production smoke tests, including authentication, enquiry submission, database and mail workflow checks.
Retain release and recovery evidence.
7. Patching and vulnerability management
Controlled updates, release checks and review of relevant security advisories are in place. The approved operating model uses pre-release dependency checking, weekly review of critical advisories, monthly routine patch and scan activity, quarterly external-exposure and security-header review, and immediate assessment of actively exploited critical issues.
Automated dependency scanning, container-image scanning and recurring external vulnerability scanning continue to be formalised as maturity work. Paulioskos does not currently claim that the website has completed an independent penetration test.
8. Logging and monitoring
The platform records proportionate operational and accountability information, including named administrative sign-in and sign-out events, enquiry workflow changes, mail events, delivery status, errors, service health and relevant provider audit information.
Routine operational checks are performed, but central log correlation, comprehensive automated alerting and 24/7 monitoring are not currently claimed. Relevant evidence is preserved where an incident, complaint or legal matter requires it.
9. Backup, recovery and incident response
The production VPS is protected daily using Veeam Agent.
Material releases create additional pre-change PostgreSQL and configuration copies.
A documented recovery sequence covers safe isolation, data validation, application rebuild and service verification.
A security incident and personal-data-breach process defines containment, evidence preservation, recovery and notification assessment.
A complete isolated Veeam restore is scheduled as a formal assurance action; full restore capability is not yet claimed as independently evidenced.
10. People, suppliers and delivery partners
Paul, Dianne and Edward receive role-appropriate security and data-protection awareness. Future contractors must sign confidentiality and appropriate data-protection terms, receive a security briefing, use named identities and approved systems, and have access removed at the end of the engagement.
Material suppliers are recorded and reviewed for service dependency, processing location, contractual safeguards, access, continuity and exit considerations. Supplier assurance is still being formalised and is not described as complete across every provider.
11. Assurance limits
Paulioskos is not certified to ISO/IEC 27001, ISO 22301, Cyber Essentials, Cyber Essentials Plus or IASME Cyber Assurance.
No independent website penetration test is currently claimed.
No guarantee of complete security, uninterrupted availability, zero data loss or immunity from cyberattack is given.
The phrase “24/7 recovery mindset” is an engineering philosophy, not staffed 24/7 support, monitoring or an SLA.
Contact
| Route | Details |
|---|---|
| Security reports | [email protected] |
| General enquiries | [email protected] |
| Responsible disclosure policy | Paulioskos Trust Centre |
Reference framework
These references explain the legal and good-practice framework used when preparing this document. They do not represent certification, accreditation, endorsement or legal advice.