How Bioznow treats security as part of the work, not a sticker.

Secure software development

Changes move through review, automated checks and staged environments before production. We practise least privilege for people and services. Secrets are not stored in git. Dependencies are reviewed and kept current as part of ordinary engineering, not as a once-a-year event.

Encryption and hosting

Data in transit uses TLS 1.2 or later. We prefer UK or clearly documented regions for customer data, with access limited to those who need it. Static sites such as this one are served over HTTPS, with a content security policy, clickjacking protections and a restrictive referrer policy. We use established hosting and content-delivery networks and keep administrative access off shared laptops without disk encryption and multifactor authentication.

UK data protection

We design for UK GDPR and the Data Protection Act 2018. We expect to be able to explain lawful basis, retention and subprocessors in plain British English. We take an ICO-minded view: register where required, minimise what we collect, and avoid cleverness with personal data. This website itself collects only what you choose to send via email.

Incident response

We maintain a high-level incident process: detect, contain, assess, notify those who need to know (including customers and, where the law requires, the ICO), then repair and write down what changed. We do not publish playbooks that would help an attacker. Customers on retainers have a named escalation path.

Vulnerability disclosure

If you believe you have found a vulnerability in a Bioznow system, email security@bioznow.com. Please include enough detail for us to reproduce the issue in our own environment. Do not include proof-of-concept exploit code that could harm other customers, and do not access data that is not yours. We will acknowledge within three working days. Preferred languages: English.

A machine-readable policy lives at /.well-known/security.txt. The fuller narrative is this page.

What this page does not contain

We do not publish offensive security content, exploit proof-of-concepts, or step-by-step attack guidance — including for systems we own.