Data Security Statement

Scope

The security page covers what defends the websites we run. Here is the duller companion piece: the personal data sitting behind each account, both yours and that of the people who buy from you, plus the measures Article 32 of the UK GDPR expects from us.

1. Encryption

Every request on this site and inside the client area moves over TLS, and Strict Transport Security is set so a browser will refuse to downgrade. Certificates renew on their own. An expired one is an outage nobody should still be suffering in 2026.

Every password is salted and hashed. Support cannot read yours back to you, and neither can anybody else here. A reset is the only route open, which is precisely why nobody from this company will ever ask you for your password. Card numbers never touch our systems in the first place. The payment provider keeps them, while we hold a token and the last four digits.

2. Access

Where a system holds personal data, access goes to named individuals on the basis of need, and it closes once the need has gone. Administrative access carries two-factor authentication on top. Shared logins are used by nobody here, since an action that cannot be traced back to a person cannot be answered for by one.

Your account, your services and your tickets are visible to support. Reading through your files or your database is not part of the routine. Where a request genuinely calls for it, that happens with your knowledge and for that one request only.

3. Isolation, patching, resilience

Accounts that share a machine are walled off from each other, so one site being breached does not turn into five hundred sites being breached. Platform software stays current, malware scanning never stops, and a web application firewall with network-level attack mitigation sits in front of the lot.

Copies are taken daily, and restoring one is something you do yourself. They stay a convenience, not a warranty. The service level agreement states in plain terms that it pays out on availability, never on lost data.

4. Location and suppliers

The hosting hardware sits in the United Kingdom. Personal data gets handled inside the UK and the EEA, while any supplier working outside that area falls under the safeguards named in the privacy policy, where the suppliers themselves are also listed by name.

A supplier gets reviewed before we adopt them, and is then held to written terms at least as strong as the ones we owe you. Where the processing is done on your behalf, the data processing addendum governs it.

5. Retention

Full periods live in the privacy policy. In broad terms: account and billing records survive the life of the account plus six years, because tax law demands it; tickets for three years; raw server logs for a few weeks.

Cancel a service and its data drops out of live systems on schedule, then ages out of the backups afterwards. Editing a backup surgically to satisfy a deletion request is not something we do, because that destroys the integrity of the backup itself. We let them expire instead, and throughout that period the data stays unavailable for any use.

6. The breach clock

Any personal data breach likely to put people at risk goes to the Office of the Information Commissioner inside 72 hours of the moment we become aware. Should the risk to individuals be high, those people hear from us direct, and fast.

Where the data belongs to you and our role is only to process it, you get told without undue delay, since your own 72-hour duty as controller begins to run whether or not anybody has pointed that out to you.

Reporting something that turns out to be nothing beats sitting on it while working out how the thing is going to look.

7. Reporting a weakness

Found a hole? info@hostingfastnet.com, ahead of anywhere else, and give us a fair window in which to fix it. That same contact appears in machine-readable form at /.well-known/security.txt.

Test against your own account and nothing else. Leave data belonging to anybody else untouched, and run no denial-of-service experiments. Research kept inside those lines is welcome, and we will not come after you for it.

8. Your half

None of the above updates your plugins, thinks up strong passwords for you, or removes the contractor still holding your FTP details. Those duties sit in the acceptable use policy, and between them they explain most of the compromises we genuinely see.

9. The company

HostingFast is a trading name of Vitalcare at Home Ltd, a company registered in England and Wales under Company No. 15098204. Registered office: Office 4648, 221–323 High Road, Chadwell Heath, Romford, England, RM6 6AX. Security contact: info@hostingfastnet.com.