Security

How we protect your information

A plain summary of how we protect what you give us.

Draft for review. This page is not final until Steve Tunstall has approved the wording.

Your answers

• Answers to the questions are stored under a scrambled session ID, with no name or email, until you choose to get your PDF.
• Your anonymised answers feed a benchmark only as structured data, and nothing is published from fewer than five organisations.

Signing in

• Email one-time codes expire after 10 minutes and allow a limited number of attempts.
• Paying clients and our own admins sign in with two-factor authentication.
• Admin access is limited to named people. Every admin view of a report and every file download is logged.

Your documents

• Uploads are optional, stored privately, and encrypted at rest.
• Only PDF and Excel files are accepted. Files are checked by their contents, scanned for malware, and held in quarantine until clean.
• Files are never available through public links. Downloads use short-lived links created only after an access check.

Payments

• Card details go directly to Stripe and never touch our servers.
• Orders are fulfilled only from payments confirmed by Stripe.

The platform

• Hosted on Google Cloud in Singapore, with abuse protection, rate limits and strict browser security headers.
• Secrets are kept in a managed secret store, never in code.
• Daily encrypted backups, kept for 30 days.
• The site was security tested before launch and findings were fixed and re-tested.

Found a problem?

Please tell us at the address below. We will look at it promptly.

Last updated: 20 October 2026. Questions: gretchel@tunstallasc.com