Security & Compliance

Security & Data Protection

Your trust is our priority. We employ industry-leading security measures to protect your data and comply with UK data protection regulations.

End-to-End Encryption

All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.3. Sensitive data at rest is encrypted with AES-256.

UK GDPR Compliant

We're fully compliant with UK GDPR and the Data Protection Act 2018, respecting all data subject rights.

Privacy by Design

Privacy is embedded into every feature we build. We follow data minimisation principles and never sell your data.

Secure Infrastructure

Servers hosted in ISO 27001 certified data centres with 24/7 monitoring, automated threat detection, and redundant backups.

Database Security

Row-level security policies ensure users can only access their own data. Parameterised queries prevent SQL injection.

Access Control

Role-based access control restricts internal access to data. Admin actions are logged and auditable.

How We Handle Your Data

Transparency in what we collect, why, and how long we keep it.

Phone Reports

Community-submitted reports stored with optional email. IPs purged after 90 days.

Retention: Reports retained indefinitely; IPs purged after 90 days

Account Data

Email, claimed phone number, and verification status stored securely. Password hashes use bcrypt.

Retention: Retained while account active; deleted within 30 days of closure

SMS Verification

Verification codes hashed before storage and expire after 15 minutes.

Retention: Codes expire after 15 minutes; logs deleted after 30 days

Analytics

Anonymous usage analytics. No personal identifiers included.

Retention: Aggregated data retained for 12 months; raw events purged after 90 days

Our Security Commitments

Regular security audits and penetration testing

Multi-factor authentication for account access

Automatic session expiry and secure logout

Data minimisation — we only collect what's necessary

Right to deletion — request removal of your data anytime

Transparent data processing with clear privacy notices

Incident response plan with 72-hour breach notification

Annual security training for all team members

Vulnerability disclosure programme for responsible reporting

Third-party dependency scanning and automatic updates

Compliance & Standards

UK GDPR Compliant

TLS 1.3 Encryption

ICO Registered

ISO 27001 Hosting

Operated by Central Contacts Ltd (No. 16913912). Security contact: security@gotmynumber.co.uk

Report a Vulnerability

We take security seriously. We commit to acknowledging reports within 24 hours and providing a fix timeline within 72 hours.

Email: security@gotmynumber.co.uk