Security & Trust

Straight2PDF is operated by WFA Support Ltd. This page summarises the safeguards and operating practices we use to protect the platform. It should be read alongside our Privacy Policy, Terms and Conditions and Data Processing Agreement.

1. Security approach

We use reasonable technical and organisational measures designed to protect customer data, maintain service availability and reduce the risk of unauthorised access, loss or misuse. Security controls are reviewed as the service changes, and this page only describes controls that are in place today.

2. Hosting and infrastructure

• Core hosting is provided in the United Kingdom by 24host.uk.
• The public website is designed to limit exposure of private application logic and non-public service files.
• All connections use HTTPS, with HTTP Strict Transport Security and other security headers.
• Private application configuration, service logic and customer file storage are kept under server-side locations outside the public web root.
• Backups and operational copies may be used to support resilience, recovery and service continuity.

3. Account and access controls

• Access to customer areas requires authenticated accounts.
• Role and permission checks are used to limit access to customer-specific data and admin functionality.
• Session cookies use security-focused settings to help reduce unauthorised access and misuse.
• Passwords are hashed and are not stored in plain text.
• Two-factor authentication is required to sign in to the website, admin area and mobile app.
• Two-factor authentication secret keys are encrypted at rest using AES-256-GCM.
• Admin and support areas apply role, customer and support-session checks so users can only access permitted company data and system tools.

4. Password and session safeguards

• New passwords must meet a minimum length (12 characters) and complexity policy (uppercase, lowercase, number and symbol required).
• Recent password reuse is checked against the last 12 passwords, and accounts can be marked for forced password change where needed.
• New passwords are checked against known data breaches (Have I Been Pwned). Only part of a one-way hash is sent, never the password.
• Repeated failed sign-in attempts are rate limited or locked out to reduce brute-force risk.
• Mobile/API access uses signed, time-limited access tokens and refresh-token handling after successful authentication.

5. Data protection

Customer form submissions, uploaded content and generated documents are processed to provide the Straight2PDF service. Uploaded files and generated PDFs are access-controlled through account and permission checks. We do not use customer form content for advertising. Data processing commitments are described in our DPA.

• Customer files and generated outputs are stored in private server-side storage paths rather than public website folders.
• Generated PDFs and workbooks are encrypted at rest using AES-256-GCM with per-customer derived keys.
• Template upload validation includes file type, size, ZIP structure, unsafe path and macro checks for supported Excel template uploads.
• Customer-uploaded files are encrypted at the application layer using AES-256-GCM with per-customer derived keys.
• Form submission data stored in the database is encrypted at rest using AES-256-GCM with per-customer derived keys.

6. Monitoring, logging and auditability

We may record access logs, application logs, account activity, policy agreement records, page visit analytics where consent applies, rate-limit events, backup actions, submission workflow events and error logs to help operate, secure and improve the service. Technical logs are handled in line with our Privacy Policy.

• Sensitive administrative actions (user enable/disable/delete, 2FA resets, customer account deletion) are recorded in an append-only audit trail that cannot be changed through the app, for GDPR Art. 5(2) accountability purposes.

7. Backups and resilience

Database and customer-file backups are encrypted at rest using AES-256-GCM and checked with checksums and content validation. Our backup tools include test restores, so we can confirm backups can be recovered. We keep the five most recent backups of each type (about five days) on the main server, and our host, 24host.uk, keeps a nightly copy on a separate server in the UK for 30 days. Backups are never used for normal customer access.

8. Incident handling

If we identify a security incident affecting customer data, we will investigate, take appropriate containment steps and notify affected customers or regulators where required by law. We maintain a formal breach register to record, track and manage data breach incidents, including the 72-hour ICO notification requirement under GDPR Art. 33.

9. What we do not currently offer

We do not currently offer single sign-on (SAML/OIDC), a configurable web inactivity timeout, SOC 2 or ISO 27001 certification, or published penetration-test reports. Uploaded files are not currently scanned for malware, so treat attachments from outside your organisation with the usual care. If you need any of these for a Business or enterprise account, please contact us.

10. Customer responsibilities

• Use strong passwords and keep credentials secure.
• Assign access only to people who need it.
• Keep devices used with Straight2PDF secure and updated.
• Report suspected account compromise or security concerns promptly.

11. Responsible disclosure

If you believe you have found a vulnerability, please contact support@straight2pdf.co.uk with enough detail for us to investigate, including affected URLs, steps to reproduce, potential impact and your contact details. Please do not access, alter, delete, download or disclose data that does not belong to you, disrupt the service, or perform destructive testing.

If you act in good faith and follow these guidelines, we will treat your research as authorised under our Acceptable Use Policy, we will not take legal action against you over it, and we will work with you to understand and fix the issue. Our security contact details are also published at /.well-known/security.txt.