How We Protect Your Work

How We Protect Your Work

Everything you send is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), stored on EU infrastructure and deleted after 90 days unless you ask us sooner. Access is limited to the named verifier on your engagement.

• Managed authentication for client accounts.
• Strict browser security headers on every page of this site.
• Least-privilege access to our systems.
• Daily encrypted backups with tested restores.
• Continuous error monitoring.
• Code review against the OWASP Top 10, with issues fixed before we publish.

Where Your Data Goes

We use a small number of trusted providers to host our systems, send email, take payments and run AI models. Each one is listed, with what it does and where it operates, on our Sub-processors page.

We do not use your material to train AI models. You can ask us to delete your material at any time — see the Privacy Policy or the Privacy Centre.

Report a Vulnerability

If you think you have found a security issue in our website or services, email om@thrivefinity.uk with [Security] in the subject line. Please include the address affected, what you found and the steps to reproduce it.

• We acknowledge your report within 2 working days.
• We share a fix timeline within 7 working days.
• We credit researchers who wish to be named.
• We will not take action against good-faith research.

Acknowledgments

We thank researchers who report issues responsibly. With your permission, we list your name here once the issue you reported is fixed. No researchers are listed yet.