Security and data protection
Last updated
We build systems that hold donor, pupil, client and staff records. This page says how we protect that data, in plain words. It lists what we do today, and it lists what we do not have yet, because you should know both before you trust us with anything.
Who is responsible for what
When we build or look after a system for you, your organisation is the data controller and Tibyan Labs is the data processor. That means you decide what data is collected and why, and we handle it only on your written instructions.
We sign a data processing agreement with you before we handle any personal data for you.
How we work
- Your accounts, not ours. Wherever possible your system runs in hosting and database accounts in your organisation’s name. You can see every bill, and you can remove our access at any time.
- One client, one set of everything. Each client has its own code repository, its own environments and its own credentials. Nothing is shared between clients.
- Sign-in. Access uses multi-factor sign-in, and access to your systems is removed when the work ends, if you ask.
- We build with made-up data. We do not need your live records to build or test your system. Real personal data stays out of test data, logs and monitoring.
- AI tools never see your personal data. We use AI tools to help write and check code. We do not put personal data from your live systems into them. How we use AI explains what a person always reviews.
How the systems are built
- Each person sees only what their role allows, and that rule is enforced in the database, not only on the screen. A parent cannot see another family’s records by changing a web address.
- Data is encrypted in transit and at rest by the hosting platform. The proposal for your project names the platform and where your data is stored.
- Automated tests run before every release.
- Backups are taken by the hosting platform, and on Care Plus and Care Systems we test every quarter that a backup can be restored.
- An audit trail of who changed what is included in Portal Core and larger systems.
- Export and deletion. Every portal includes a way to export or delete one person’s data, so you can answer a request under data protection law.
If something goes wrong
If we become aware of a security incident affecting your data, we will tell your named contact without delay, with what we know, what we have done and what you may need to do. Reporting to the Information Commissioner’s Office, where it is required, is the controller’s decision, and we will give you what you need to make it.
We work Monday to Friday, 9am to 5pm UK time. There is no out-of-hours or weekend cover, and we do not monitor systems around the clock. If you need that, we are not the right supplier, and we would rather say so now.
What we do not have yet
Tibyan Labs is a new, one-person studio, and we will not claim what we do not hold.
- Cyber Essentials: not certified.
- ICO registration and insurance: these follow the company’s registration and will be listed here with their reference numbers once in place.
- Independent penetration testing: not included in our packages. If your organisation requires it, we will scope it with a specialist firm and quote it as a separate line.
- ISO 27001, a security team, a 24-hour operations desk: no, and not planned. We are one senior engineer.
Questions and questionnaires
If your organisation has a supplier or due diligence form, send it and we will complete it before any agreement is signed. If an honest answer is “no”, we will write “no”.
Reporting a problem
If you believe you have found a security problem in this website or in a system we built, email hello@tibyanlabs.com with “Security” in the subject line. We will reply within two working days, and we will not take action against anyone who reports a problem in good faith.
Our security.txt file gives the same contact in the standard format.
See also: privacy notice, how we use AI and what you own.
Printed from tibyanlabs.com/security. Page last updated 10 November 2026.