Last reviewed 30 September 2026
Captivated Ltd builds software and runs a small number of live services, and we treat the security of information as a first-order concern rather than an afterthought. Our approach is grounded in real experience: the people responsible for it have spent more than fifteen years in security-adjacent technology and have led organisations through repeated ISO 27001 certification.
We will be straight about where we stand. Captivated is a young company, and we do not yet hold formal certifications such as Cyber Essentials or ISO 27001. We apply the principles those schemes are built on, and we intend to certify as the company grows. What follows is how we work today.
Data protection and privacy
We handle personal data in line with the UK GDPR and the Data Protection Act 2018, and we are registered with the UK Information Commissioner's Office under reference ZC010118. We collect as little personal data as we reasonably can, use privacy-friendly, cookieless analytics, and share data only with service providers who are bound by appropriate data processing terms. How we handle personal data on this website is set out in our Website Privacy notice, with related detail in our Data Protection Agreement and AI Policy.
Encryption
- In transit. Our websites and services are served only over HTTPS, with HTTP Strict Transport Security and modern TLS.
- At rest. Company devices use full-disk encryption, and we favour providers that encrypt stored data by default.
Authentication and access
We use strong, unique credentials managed in a password manager, and we enable multi-factor authentication on every account that supports it. Access follows the principle of least privilege: people and services get only what they need, accounts are not shared, and access is reviewed and removed once it is no longer needed.
Secrets and credentials
Secrets such as API keys and signing keys are kept in dedicated secret stores and operating-system keychains. They are never committed to source control and never written into logs. Production credentials are kept separate from development ones, and keys are rotated when people or circumstances change.
Secure development, and this website
We keep dependencies to a minimum, prefer well-maintained libraries, and pin them with lockfiles so builds stay reproducible and reviewable. Source code lives in private repositories, and we are careful about supply-chain risk, including unreviewed install scripts. This website itself is deliberately simple: it has no user accounts, no logins, and no data collection beyond aggregate, cookieless analytics, and it returns a modern set of security response headers, including HSTS, content-type and framing protections, a strict referrer and permissions policy, and a Content Security Policy.
Infrastructure and suppliers
We run on reputable infrastructure providers and choose suppliers that meet recognised security standards and will sign data processing agreements. Administrative access to our infrastructure is restricted and protected by multi-factor authentication.
Devices
The devices we work on are encrypted, kept up to date, and set to lock automatically. We keep the number of systems that can reach sensitive data small.
Monitoring and incident response
We keep logs appropriate to each service and review them when something looks wrong. If a security incident did occur, we have a process to contain it, understand it, and put it right, and we would notify the people affected, and the ICO where the law requires it, within the relevant timeframes.
Reporting a vulnerability
If you believe you have found a security vulnerability in one of our sites, apps, or services, we would like to hear about it. Please email [email protected] with enough detail for us to reproduce the issue. We welcome good-faith security research and will not pursue or support legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to respond before any public disclosure. Please do not access or change data that is not yours, and do not run automated scanning that degrades our services. Machine-readable contact details are published at /.well-known/security.txt.
Standards, and what is next
Our practices are informed by the NCSC Cyber Essentials scheme and the ISO 27001 framework. Formal certification is on our roadmap as the company scales, and we will update this page as our posture changes.
Contact
For any question about security or data protection, email [email protected], or [email protected] for general enquiries.