Trust
Security
Last updated: [DATE]
Peppercorn One holds financial and safety information about people’s homes. We treat security as a feature of the product, not an afterthought. This page describes what we do, factually. We do not claim certifications we do not hold.
Encryption
All traffic to Peppercorn One is encrypted in transit using HTTPS. Data and uploaded documents are encrypted at rest by our infrastructure providers.
Access control
Access is enforced in the database itself using row-level security, so a user can only reach the buildings and packs they are entitled to — not merely hidden in the interface, but blocked at the data layer. Entitlement checks are performed on the server. Administrative keys are used only on the server and are never present in the browser.
Documents
Uploaded files are stored in a private store, isolated per account. Downloads use signed links that expire after a short period; documents are never served from a public address. Uploads are validated by their actual file type and size before they are accepted.
Audit logging
Meaningful actions — confirming an answer, issuing a pack, sharing a link — are recorded in an append-only activity history attributed to a named person and time.
Sharing
Packs are shared through unguessable links that you can set to expire and can revoke at any time. Access to a shared pack is logged.
Data location and backups
We host in the UK/EEA where possible and take regular backups. We test our ability to restore from backup. [CONFIRM DATA RESIDENCY AND BACKUP CADENCE.]
Reporting a vulnerability
If you believe you have found a security issue, please tell us at [SUPPORT EMAIL]. We will acknowledge your report and keep you updated. Please give us a reasonable opportunity to resolve an issue before disclosing it publicly.
If something goes wrong
We maintain a documented process for handling security incidents, including our obligation to notify the Information Commissioner’s Office within 72 hours of becoming aware of a qualifying personal data breach, and to inform affected people where required. How we handle personal data is set out in our Privacy Policy.