Security & Data

Effective date: {{POLICY_DATE}}
Last updated: {{POLICY_DATE}}

Security approach

PBJ Media Solutions applies risk-based administrative and technical safeguards appropriate to the information, system and work involved. Safeguards reduce risk but cannot eliminate it.

Website data and client-controlled data

Ordinary website data includes enquiries, appointment requests, consent preferences, technical request information, security logs and optional analytics information.

A contracted engagement may require access to client-controlled databases, credentials, hosting accounts, employee or customer information, production systems or business records. That access is governed by the applicable proposal, statement of work, service agreement, confidentiality terms and data-processing terms—not solely by the website Privacy Notice.

Access controls

Access should be limited to authorized personnel and providers with a reasonable need for it. PBJ Media Solutions applies least-privilege principles and separates environments or responsibilities where appropriate.

Encryption in transit

The public website uses HTTPS to protect information in transit between a visitor’s browser and the website. This statement does not claim that every stored record or every external system is encrypted in all circumstances.

Database and server protection

Website controls include security headers, bounded request sizes, request identifiers, CSRF protection, rate limiting, automated-submission checks, server-side validation, parameterized database queries and restricted error responses. Infrastructure details that could weaken security are not published.

Monitoring and logs

Reasonable logging supports security review, troubleshooting, abuse prevention and service reliability. Log retention follows the standard described in the Privacy Notice and may be extended for an active investigation or legal requirement.

Backups and recovery

PBJ Media Solutions uses backup and recovery controls appropriate to the service. Backups reduce operational risk but do not guarantee zero data loss, immediate restoration or uninterrupted availability.

Service providers

Providers may support hosting, database services, email delivery, DNS and networks, monitoring, security and backups. Access is restricted to what is reasonably necessary. See the Privacy Notice for more information.

Client credentials and access

Credentials or privileged access for contracted work should be provided only through an approved channel defined for that engagement. Do not submit passwords, API keys, private keys or production credentials through the general Contact form.

Data minimization

PBJ Media Solutions seeks only the information and access reasonably necessary for a defined website purpose or agreed scope of work. Access should be reduced or removed when it is no longer required.

Retention and disposal

Website retention follows the operational standards in the Privacy Notice. Client-controlled information may be subject to additional contractual or legal requirements. Retention enforcement may include documented manual review and does not imply automatic deletion.

Incident response

Suspected incidents are investigated and reasonable containment, remediation and recovery measures are taken. Affected persons or regulators are notified where legally required.

Responsible security reporting

Report a suspected website security issue through the Contact page. Include the affected public URL, a clear description, safe reproduction details and contact information. Do not include credentials or unrelated personal information.

Reporters must not access unrelated data, disrupt systems, alter records or publicly disclose an unresolved issue. This reporting route is not a bug-bounty programme and does not promise payment or authorization to test beyond ordinary lawful access.

No absolute guarantee

No online system can be guaranteed completely secure. PBJ Media Solutions reviews safeguards as systems, risks and services evolve.