Security & Compliance

BuildQS is designed with security as a core principle. We implement industry-standard security controls to protect your data and ensure compliance with UK regulations.

Security Overview

• TLS/HTTPS Encryption - All data in transit is encrypted using TLS 1.3
• Data at Rest Encryption - Database encrypted with AES-256
• Two-Factor Authentication - Optional 2FA via authenticator app or email
• Role-Based Access Control - Granular permissions per project

Security Headers & Controls

HSTS enabled, Content-Security-Policy, X-Content-Type-Options (nosniff), strict Referrer-Policy, X-Frame-Options (SAMEORIGIN), and rate limiting (200 req/min global, 5/15min authentication).

OWASP Top-10 Mitigations

Our security controls address the OWASP Top 10 web application security risks including broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity failures, logging failures, and SSRF.

Backup & Recovery

• Recovery Point Objective (RPO): 24 hours
• Recovery Time Objective (RTO): 4 hours
• Daily automated database backups (Neon PostgreSQL)
• Point-in-time recovery available (last 7 days)
• Restore drills conducted quarterly

UK GDPR Compliance

Construgantt Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. A Data Protection Impact Assessment (DPIA) has been conducted. Users can exercise rights including access, rectification, erasure, portability, restriction, and objection.

Data Protection Officer: Katarzyna Machalinski, FCMA

Company: Construgantt Ltd, Farriers Chambers, 4 Smith Street, Rochdale, OL16 1TU. Company No. 15297281.