Securing our internal environment

Controlling staff access

We grant staff access according to their role and the permissions they need to carry out their work. Requests for elevated permissions require approval, and we review those permissions regularly.

Multi-factor authentication is mandatory for access to our internal business systems. Authorised staff access to security audit records is controlled and auditable, supporting service operation, investigation and support.

Protecting staff devices

Staff devices used to access our internal network must be enrolled in our device-management service. This enforces security requirements including encryption, password protection, anti-malware protection and supported operating-system versions.

We keep internal applications updated with security patches and run daily malware scans on applicable endpoint devices, alongside real-time protection. Staff are notified when a device fails our compliance checks. Access to the internal network is restricted if the issue is not resolved within the required timeframe.

Security awareness

All team members receive security awareness training when they join and annually thereafter. Training covers phishing, device security and data protection. We also use phishing simulations to reinforce awareness, and staff can contact our security team for guidance and support.

For information about customer account authentication, see Product login protections.

Cyber Essentials certified

Cyber Essentials is an effective, Government backed scheme that helps protect our organisation against a whole range of the most common cyber-attacks.

View certificate