Security & Data Protection
Recipes and supplier data are commercially sensitive. This page summarises the measures we use to protect them.
Last updated: 14 October 2026
01Tenant isolation
Every organisation's data is separated at the database level with row-level security policies, so one customer cannot read or change another's records, even through the API.
02Access control
Role-based permissions (owner, admin, approver, editor, viewer, consultant). Final approvals are enforced in the database, not just the screen. Platform administrator rights are held in a separate protected roles table.
03Integrity of records
Approved versions and decision records cannot be edited. Material regulatory changes are committed in single database transactions, so partial changes cannot persist. Concurrent edits are protected against lost updates.
04Encryption
All traffic uses HTTPS/TLS. Data is encrypted at rest by our hosting provider. Payment card data is handled only by Stripe (PCI DSS Level 1).
05Secrets and keys
Service credentials are stored server-side and never sent to the browser.
06Backups and continuity
Our hosting provider maintains regular backups. Customers can export their records at any time.
07Incident response
We investigate security events promptly and will notify affected customers without undue delay, and the ICO within 72 hours where required.
08Report a vulnerability
Email security@foodsafeformulate.co.uk. Please do not publicly disclose an issue until we have had a reasonable chance to fix it.
These documents are provided for information about how FoodSafe Formulate operates. They do not constitute legal advice to you.