Security

Security is part of how we build every product. This page summarises how we protect our services and the data our customers trust us with, and how to report a vulnerability.

Infrastructure

• HTTPS everywhere, with HTTP Strict Transport Security (HSTS).
• Security headers on every page, including a Content Security Policy, clickjacking protection and strict referrer handling.
• Our public site loads no third-party scripts, trackers or advertising.
• Servers are kept patched, and administrative access is restricted.

WhatsApp messaging (PHV Connect)

• Businesses connect through Meta's official Embedded Signup. You sign in on Meta's own page — we never see or store your Facebook password.
• Access tokens issued by Meta are encrypted at rest and never sent to the browser.
• Every webhook from Meta is checked against its HMAC-SHA256 signature before it is processed; unsigned or altered requests are rejected.
• Each business's data is kept separate and is only reachable with that business's credentials.
• You can revoke our access at any time from your Meta settings — see Data Deletion.

People and process

• Least-privilege access: staff can only reach the data their role needs.
• Data is used only to provide the service — never sold, never used for advertising.
• If a breach affects your data, we will tell you without undue delay and explain what we are doing about it.

Report a vulnerability

If you think you've found a security issue in any PHV website or service, please email info@phvtech.com with the subject "Security report", including steps to reproduce it.

• We'll acknowledge your report within 3 working days.
• Please give us reasonable time to fix the issue before making it public.
• Don't access, change or delete other people's data, and don't run tests that disrupt the service.

We also publish security.txt.