Data Security Statement

Scope

The security page covers what defends hosted websites. This covers the personal data behind the accounts — yours, your customers', and their customers' — and the measures Article 32 of the UK GDPR expects.

1. Encryption

All traffic to this site and the client area runs over TLS with HTTP Strict Transport Security set, so browsers will not downgrade. Certificates renew automatically.

Passwords are salted and hashed and cannot be read back by support or anyone else here — a reset is the only route, which is why nobody from this company will ever ask for yours. Card data never touches our systems; the payment provider holds it and we keep a token and the last four digits.

2. Access control

Access is granted to named individuals on need and withdrawn when the need ends. Administrative access requires two-factor authentication. Shared logins are not used, because an unattributable action is an unaccountable one.

Support sees accounts, services and tickets. Reading file contents or database rows is not routine; where a request needs it, it happens with your knowledge and for that request only.

3. Isolation between accounts

This matters more on a reseller platform than almost anywhere: accounts sharing hardware are isolated, so one of your customers being breached is not all of them being breached. Platform software is patched, malware scanning runs continuously, and a web application firewall with network-level mitigation sits in front.

Daily copies are taken and restorable without a ticket. They are a convenience, not a warranty — the service level agreement pays on availability and never on data loss.

4. Location and sub-processors

Hosting infrastructure is in the United Kingdom. Personal data is processed in the UK and EEA; suppliers operating elsewhere are covered by the safeguards named in the privacy policy, which lists them. Suppliers are assessed before adoption and bound by terms no weaker than those we owe you.

5. Retention

Periods are in the privacy policy. In outline: account and billing records for the life of the account plus six years as tax law requires; tickets three years; server logs weeks.

On cancellation data leaves live systems on schedule then ages out of backups. Backups are not edited to satisfy an erasure request — editing one destroys its integrity — so they expire instead, with the data unavailable throughout.

6. Breach notification

A personal data breach likely to risk people is reported to the Information Commissioner's Office within 72 hours of us becoming aware, and high-risk cases are communicated to those affected without undue delay.

Where we process on your behalf you are told without undue delay, so your own controller clock can be met — and if you resell, so that yours can reach your customers in time.

7. Reporting a weakness

info@hosting-seller.com, before disclosing elsewhere, with a fair window to fix. The same contact is published at /.well-known/security.txt. Test only against your own account, leave other people's data alone, and run no denial-of-service tests. Research inside those lines is welcome and will not be pursued.

8. What remains yours

None of this patches your extensions, chooses passwords, or removes a departed contractor's access — and on a reseller plan, none of it does those things for your customers either. Those duties sit in the acceptable use policy and account for most compromises seen here.

9. Contracting entity

Hosting Seller is a trading name of IGI Security Services Ltd, a company registered in England and Wales under Company No. 15881180. Registered office: 60 Tottenham Court Road, Suite 4944a, Fitzrovia, London, United Kingdom, W1T 2EW. Security contact: info@hosting-seller.com.