Security

This page explains how Grid Design keeps client information safe: how our own systems are set up, who can see what, how we build and look after the websites we deliver, and what we do if something goes wrong.

We are a small, senior studio, and we have set things up so that security is part of how we work rather than a layer added on top. Where we rely on other companies, we use established providers that are independently certified, and we say who they are.

For what personal information we collect and why, see our Privacy Policy. For how we handle data on a client's behalf during a project, see GDPR & Data Protection.

Who we are

Grid Design Agency Limited is a UK company registered in England and Wales. We are registered with the Information Commissioner's Office and we carry business insurance appropriate to the work we do. Details are available on request.

How your information is kept apart

Client work runs inside Margin, our own private workspace. Keeping project information in one system we control, rather than spread across inboxes and shared folders, is what lets us decide exactly who sees what.

Every account in Margin has a role, and each role sees only what it needs:

• Clients see their own projects, files and invoices, and nothing belonging to anyone else
• Contractors see the tasks and briefs they are assigned to. They do not see client names, contact details or anything to do with money
• Grid staff see the projects they run. Billing and commercial information is limited to the people responsible for it

There is no public sign-up. You have an account only because someone at Grid invited you, and access is removed the day an engagement ends.

Where your information is held

In the United Kingdom.

• The database behind Margin and this website is held in London, United Kingdom
• Margin and this website are served from London, United Kingdom

The companies that provide this infrastructure hold independent security certifications, including SOC 2. A full list of our sub-processors, with the location and safeguard for each, is available from dataprotection@griddesign.co.uk.

Information is encrypted in transit and at rest.

Signing in

There are no passwords in Margin. You sign in with a six-digit code sent to your email address, which expires after a short time, or with your Google account if you prefer. With no password, there is nothing to reuse, guess or leak.

Across the business we use multi-factor authentication on email, file storage, design tools and hosting, and a managed password manager. Nobody shares logins.

Our people and contractors

Grid is senior-led, working with a network of specialist contractors chosen for each project.

• Everyone who works on client projects signs written confidentiality and data protection terms before they start
• Contractors work inside Margin and see only what their task needs
• Access is given per project and removed the day the work ends
• We do not put client confidential information or personal data into an AI tool without the client's prior written agreement. Where AI tooling is agreed, model training on our inputs is switched off and a person reviews everything before it is delivered

The websites we build

Most of the sites we build are what is called headless: the content management system where your team edits pages is kept separate from the public website. In practice that means:

• The editing system is not on the public website. There is no login page sitting on your public domain for anyone to try
• The public site is made of ready-built pages served from a global network, so there is very little for an attacker to interact with
• No plugin marketplace. Features are built into the site rather than added through third-party plugins, which is where most website security problems start
• Security settings are set once, for every page. We ship with security headers in place from launch

Agreeing what runs on your site

A content security policy is a list of what your website is allowed to load and run. We agree that list with your team at the start, covering things like analytics, forms and chat. If a new script is needed later, the list is updated deliberately. Nothing gets added quietly.

Signing in to your CMS

Logins to your content management system use strong authentication, and each person on your team gets their own account with the access their role needs.

Keeping sites patched

For sites we look after under a care plan, one named person at Grid is responsible for security, and we commit to:

• Monitoring the software your site depends on, with automatic alerts when a security issue is published
• Fixing critical issues within 48 hours
• Fixing high severity issues within 7 days
• Applying routine updates monthly
• Keeping backups, so a site can be restored if it ever needs to be

If your site is not on a care plan, we will tell you about any serious issue we become aware of in software we built, and quote to fix it.

If something goes wrong

If we become aware of a security incident that affects your information or your website, we will:

• Tell you without undue delay, and within 24 hours of confirming it
• Tell you what happened, what is affected and what we are doing about it
• Contain and fix it, and keep you updated until it is closed
• Help you meet any obligation you have to report it, including to the ICO

Afterwards we will share a written summary of what happened and what we have changed.

Reporting a security issue

If you think you have found a security problem in griddesign.co.uk, Margin or a site we have built, email security@griddesign.co.uk. A person will reply, normally within two working days.

Please give us a reasonable chance to fix the problem before telling anyone else. We will not take action against anyone who reports an issue to us in good faith.

Questions and security reviews

If your organisation needs us to complete a security questionnaire, sign a data processing agreement or talk through any of this with your technical team, email security@griddesign.co.uk. We are happy to do it.