Security

Overview

• Requio Ltd takes the security of your data seriously. This page sets out the technical and organisational measures that protect the Requio platform and your information.

Encryption

• Data in transit: all traffic between your browser and our services uses HTTPS, with TLS 1.2 or 1.3. Older versions are refused, and plain HTTP is redirected to HTTPS.
• Data at rest: our database, its backups, and the documents and files you upload are encrypted at rest with AES-256.

Authentication and Access Controls

• Passwords: stored only as a salted hash (bcrypt). We cannot see or recover your password.
• Sessions: a sign-in lasts at most seven days, after which you must sign in again. Changing your password or your email address requires your current password.
• Role-based access: access to projects, DRPs and features is controlled by role (Workspace Admin, Lead Analyst, Analyst, Reviewer, Approver). People only see what their role allows.
• Separation between workspaces: every request is checked against the workspace it belongs to, so one organisation cannot reach another's data.

Data Handling

• We process and store data only as needed to provide the Services, as described in our Privacy Policy, which also explains how long data is kept.
• Access to production data is restricted to the people who run Requio, and only for operational or support purposes.
• Every file that is stored or shown to anyone (knowledge-base documents, external requirement uploads, files sent through an upload link, project logos and images pasted into a DRP) is checked to be the type it claims and scanned for malware before it can be used. A file found to be unsafe is not kept. Files used to draw a process map are read once by the AI and never stored or shown to anyone, so they are checked for type and size rather than scanned.

Infrastructure Security

• Hosting: the platform and its data are hosted on Amazon Web Services in London (eu-west-2). AWS provides the physical security of its data centres and holds certifications including SOC 2 and ISO 27001.
• Network: our database cannot be reached from the internet. Only our application servers can connect to it, and they in turn accept traffic only through our load balancer.
• Threat detection: AWS GuardDuty watches the account, its network activity and sign-in attempts against the database for signs of attack.
• Backups: the database is backed up automatically every day, backups are kept for seven days, and it is protected against accidental deletion.
• Updates: every release is checked for known critical vulnerabilities in the software we depend on, and is blocked if one is found.

Compliance

• We design our systems and processes with data protection in mind, in line with UK GDPR and EU GDPR principles. Requio is not itself SOC 2 or ISO 27001 certified.
• For specific compliance questions or documentation requests, contact us at support@requio.co.uk.

Incident Response

• If we confirm a personal data breach affecting your data, we will tell you within 48 hours of confirming it, and notify the Information Commissioner's Office and other authorities where the law requires it.

Your Responsibilities

• You are responsible for keeping your sign-in details secure and for the actions of the people you invite to your workspace.
• Use a strong password, do not share sign-in details, and report any suspected security issue to support@requio.co.uk.

Reporting a Security Issue

If you think you have found a security vulnerability in Requio, please tell us. We welcome reports from anyone, whether or not you are a customer.

• How to report: email support@requio.co.uk with "Security" in the subject. Include what you found, the steps to reproduce it, the pages or addresses affected, and what you think the impact is. Please keep the details between us until we have fixed it.
• What we will do: acknowledge your report within 3 working days, give you an update on our assessment within 10 working days, and let you know when it is fixed.
• Good-faith research: we will not take legal action against anyone who looks for and reports vulnerabilities in good faith under this policy. That means you only access the minimum needed to show the problem, do not keep, change or delete any data, do not access other people's accounts or data, do not disrupt the service, and give us reasonable time to fix the issue before telling anyone else.
• Out of scope: attacks that try to overload or knock the service over, social engineering or phishing of anyone at Requio or its customers, physical attacks, and findings in the services we use (such as Amazon Web Services, Vercel or Stripe), which should go to those companies directly.