Security Policy
Your customer list is one of the most valuable things your business has. This page explains, in plain English, how we protect the information you keep in Bizora, how we handle it under UK data protection law, and what to do if you find a security problem. Our Privacy Policy sets out the full legal detail.
1. Data protection law
Bizora is operated by FCB Digital Ltd trading as Bizora, a company registered in England and Wales (company number 17483665). We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In the UK, data protection is regulated by the Information Commissioner's Office (ICO).
For the customer records your business keeps in its workspace, your business is the controller and Bizora processes that data on your instructions. For your own account and billing details, Bizora is the controller. We do not sell personal data, and we do not use your customer data to train AI models.
2. Where your data is stored
- Hosting in Europe. The Bizora application and database are hosted by IONOS, and your workspace data is stored on servers in Europe.
- Documents in Germany. Files you upload are kept in IONOS object storage in Germany. New uploads are encrypted at rest with AES-256.
- Payments by Stripe. Card payments are handled by Stripe. Your card number goes directly to Stripe; we never see or store it.
Section 5 of our Privacy Policy lists every service provider we use and where they process data.
3. How we protect your data
- Encrypted connections. Every page uses HTTPS, with strict security headers and a content security policy that blocks injected scripts.
- Passwords. Passwords are hashed, never stored in a readable form, and repeated sign-in attempts are rate limited.
- Secure sessions. Sign-in cookies are secure and cannot be read by scripts. You are signed out after 30 minutes of inactivity, and after 12 hours in any case.
- Workspace separation. Every request is checked against your organisation, so one business can never see another business's records.
- Team permissions. Owner, Team Moderator and Team Member roles control who in your team can do what. See team permissions.
- Protected documents. Files are only downloaded by signed-in members of the right workspace, and are never served as public or executable files.
- Safe coding practices. Database queries are parameterised, forms are protected against cross-site request forgery, and payment notifications from Stripe are signature-checked.
- Your data, your exit. Export your companies and contacts to CSV whenever you like, on every plan.
4. Keeping software up to date
Security updates to the server software that runs Bizora, including PHP, are applied by our hosting provider. We also monitor security advisories ourselves and act on them quickly. For example, when critical PHP vulnerabilities known as PHP2Shell were disclosed in October 2026, our servers were updated to a patched version.
5. Your part
Security works best when we both play our part. We recommend that you:
- Use a strong password for Bizora that you do not use anywhere else.
- Give each person their own account, with the lowest role they need.
- Remove people from your workspace as soon as they leave your business.
- Keep your own backup by exporting your data from time to time.
- Do not store sensitive information such as health details, identity documents or card numbers in Bizora. Section 2 of our Privacy Policy explains what not to upload.
6. If something goes wrong
No online service can promise to be completely secure. If we become aware of a security incident affecting personal data, we will investigate and contain it straight away. We will tell affected customers without undue delay, and where UK GDPR requires it, we will report the breach to the ICO within 72 hours of becoming aware of it. Where your workspace data is affected, we will give you the information you need to meet your own obligations as controller.
7. Reporting a security issue
If you think you have found a security vulnerability in Bizora, please email hello@bizora.co.uk with "Security report" in the subject line. Include enough detail for us to reproduce the issue. We will acknowledge your report, keep you updated and let you know when it is fixed.
While investigating, please do not access, change or delete other people's data, do not disrupt the service, and give us reasonable time to fix the issue before telling anyone else. We will not take action against anyone who reports an issue to us in good faith and follows these guidelines.
8. Questions
For questions about security or data protection, email hello@bizora.co.uk. To make a data protection request or complaint, see section 9 of our Privacy Policy.
