Security Overview

Version 1.1 — effective 29 September 2026.

Commercial Intelligence Partners ("CIP") is operated by {{COMPANY_LEGAL_NAME}} (company number {{COMPANY_NUMBER}}). Our clients trust us with their sales, costs, staff and customer records. This page explains, in plain English, how we protect that data.

We describe only controls that are in place today. CIP does not currently hold ISO 27001, SOC 2 or Cyber Essentials certification. Our main infrastructure providers hold their own certifications, which you can find on their websites (see our sub-processors page, /legal/subprocessors).

1. Keeping each business's data separate

Every client business is a separate "tenant". We keep tenants apart twice over:

• In our code. Our application reaches client data only through a data layer that is scoped to one business at a time.

• In the database. Postgres row-level security enforces the same boundary inside the database, and the application connects as a non-privileged database role that cannot bypass it.

So even if one layer had a bug, the other would still stop one business seeing another's data.

2. Encryption

• In transit: all traffic to CIP, and between CIP and our providers, uses TLS.

• At rest: our database provider encrypts stored data.

• Connector credentials: the credentials you give us to connect other systems (for example another business system you use) are additionally encrypted with AES-256-GCM before they are stored.

• API keys: we store only a hash of each API key, never the key itself. If you lose a key, you create a new one.

3. Signing in

Sign-in is run by CIP itself. Your sign-in records (sessions, passkey public keys, hashed one-time codes and authenticator-app secrets) are stored in our database in London, alongside the rest of your data. You can sign in with a one-time code sent to your email, with a passkey, or, if you choose, with your Google account (or Microsoft, where offered). Two-factor authentication (authenticator app) and passkeys are available to every user; they are required for CIP's own team (our platform administrators). We recommend owners and managers turn them on. Each person has their own login. Owners control who is invited, their role and which venues they can see. Your account page shows your recent security activity and lets you sign out other devices.

Our sign-in page and public forms use Cloudflare Turnstile, a bot-protection check, to slow automated attacks.

4. Protecting against abuse

Rate limiting slows down automated attacks such as sign-in code guessing and API abuse. Signed webhooks: payment notifications from Stripe are checked for a valid signature before we act on them, so they cannot be forged.

5. How CIP staff access your account

CIP administrators' actions are recorded in an append-only audit log that cannot be edited. If our support team needs to see what you see to help you, they use a "view as customer" mode. It is a separate session that lasts at most 30 minutes, cannot be extended, and is recorded in the audit log. Most support staff can only look: it is read-only for them. Only designated senior staff (superusers) can make changes while viewing as a customer, and their changes are audited too. Every access appears in your account's security activity, so you can see when CIP support has viewed your account. CIP staff sign-ins require a second factor.

6. Secrets and environments

Passwords, keys and other secrets for our systems are held only in our hosting provider's encrypted environment settings. They are never stored in our source code. Our testing and user-acceptance environments are separate from production and use scrubbed data, not live client data.

7. Backups and recovery

Our database provider takes continuous backups with daily point-in-time recovery, so we can restore data after an accident. Backups roll off automatically, in line with our Data Retention and Deletion Policy (/legal/retention).

8. Where your data is

The CIP application runs in London, on Vercel. The database is hosted by Neon in London, United Kingdom (AWS eu-west-2). Some providers are US companies. Our sub-processors page (/legal/subprocessors) lists each one and how UK data transfers are protected.

9. AI features

AI commentary is off unless enabled for your account. When it is on, the AI model receives figures that CIP's own software has calculated, and writes words around them. It does not do the maths. Our AI provider, Anthropic, does not train its models on your data under its commercial terms.

10. If something goes wrong

If we become aware of a personal data breach affecting your data, we will tell your account owner without undue delay, and within 48 hours, as our Data Processing Agreement (/legal/dpa) sets out, and help you with any notifications you need to make.

11. Reporting a vulnerability

We welcome reports from security researchers.

• Email: info@commercialintelligencepartners.co.uk with the subject "Security report".

• Please include what you found, how to reproduce it, and its likely impact.

• We will acknowledge your report within 5 working days and keep you updated.

• Please act in good faith: do not access or change other people's data beyond the minimum needed to show the problem, do not degrade the service, do not use social engineering or physical attacks, and give us reasonable time to fix the issue before telling anyone else.

• If you follow these rules, we will not take legal action against you for your research, and we will credit you if you wish.

• Planned security testing (such as a penetration test by a client) needs our written permission first — see our Acceptable Use Policy (/legal/acceptable-use).

12. What you can do

• Turn on two-factor authentication or add a passkey.

• Give each person only the access they need, and remove leavers promptly.

• Keep API keys secret and revoke any you think are exposed.

• Tell us straight away at info@commercialintelligencepartners.co.uk if you suspect a problem.

Legal basis

UK GDPR Art. 5(1)(f) (integrity and confidentiality), Art. 25 (data protection by design and by default), Art. 28(3)(c) and Art. 32 (security of processing, including encryption, ongoing confidentiality, resilience, restoration of access and regular testing), Art. 33(2) (processor breach notification); ICO guidance A guide to data security. Statements about certifications are made to avoid misleading claims under the Digital Markets, Competition and Consumers Act 2024 Part 4 Ch. 1 and the Business Protection from Misleading Marketing Regulations 2008.