How we protect the information you entrust to us.
Last reviewed 21 July 2026
1. Where your data is stored
When you save an application, the portal stores its records in the access-controlled PostgreSQL database connected to the Vercel-hosted application. The production setup is designed to use Neon Postgres through the Vercel integration. The precise hosting location is determined by the region configured for that database project; contact us before submitting if you need confirmation of the current processing location.
GitHub stores the portal's source code. It is not used as a client-record or document store. Uploaded identity documents are stored as encrypted database records rather than public files.
2. Encryption in transit and before database storage
Your browser communicates with the live portal over HTTPS. Connections from the application to its production database are required to use TLS. On the application server, sensitive questionnaire data and uploaded document contents are encrypted with AES-256-GCM before being written to the database.
Each encryption operation uses a new random value and an authentication tag that helps detect altered ciphertext. The encryption key is supplied separately as a protected deployment secret and is not committed to the source repository. The application decrypts data only when it is needed for an authorised client or staff view.
3. Access controls
Returning clients need their email address and unique recovery code. The lookup values are stored as keyed hashes rather than readable recovery credentials. After access is verified, the portal issues an HttpOnly, SameSite=Strict session cookie; it is marked Secure in production. Client sessions expire after 14 days, while staff sessions expire after 12 hours.
Staff access requires a password whose stored verifier is protected with scrypt. Session tokens are stored as hashes, and document downloads are permitted only for the matching client application or an authenticated staff account. Download responses are marked private and no-store.
4. Measures that reduce misuse and common web attacks
Sensitive write requests are checked against the portal's origin, and rate limits are applied to high-risk actions such as access attempts and document uploads. Uploads are restricted to PDF, JPG, PNG or WebP files of up to 3 MB, with filenames sanitised before storage.
Browser security headers restrict where portal content can load from, prevent the site from being embedded in another page, disable MIME-type guessing, and limit access to browser features the portal does not need. Activity events are recorded to support operational review.
5. Data minimisation and separation
Application answers are stored as one encrypted payload, while uploaded document contents are stored as encrypted binary data. Operational fields such as an application reference, status, timestamps, file name, file type and file size remain available to the system so it can organise and serve the application. Deployment secrets and live client data must never be added to GitHub.
6. Retention and deletion
Personal data is retained only for the incorporation enquiry, agreed services, legal and regulatory duties, risk management, and legitimate business-record purposes described in our privacy notice. Retention is not based on an unlimited promise, and some records may need to be kept where the law requires it. You may contact PSOI to ask about access, correction or deletion, subject to applicable requirements.
7. What you can do
Keep your recovery code separate from your identity documents, do not forward it by email or messaging apps, use a trusted device and network, and sign out when you finish. Contact us promptly if you believe your code, device or application access has been compromised.
8. Honest security commitment
No internet service can promise zero risk. PSOI uses layered technical and operational controls intended to reduce the chance of unauthorised access or disclosure, and reviews these controls as the portal changes. To report a concern or ask a security question, email psoi.services2025@gmail.com.