Security and certification
What we do to keep remote access to your equipment under control, and the standards we work to.
Our customers trust us with a way into equipment on other organisations' premises. We take that seriously, and we would rather describe what we actually do than claim more than we have.
Certification and standards
| Standard | Status |
|---|---|
| Cyber Essentials Plus | Certified, October 2026. A copy of the certificate is available to customers on request. |
| ISO/IEC 27001:2022 | Information security management system in place; certification audit planned for 2027. Our statement of applicability is available to customers under a confidentiality agreement. |
| IEC 62443-2-4 | Our engineering and remote access practices follow the requirements for service providers. We do not claim certification. |
| BS 7858 | Staff with access to customer systems are screened to this standard. |
How remote access is controlled
- Every engineer has a named account. Shared accounts are not issued to engineers.
- Sign-in requires a second factor; for our own staff, a hardware security key.
- Each session must match an approved work order or maintenance window and is limited to the equipment named in it.
- Sessions are recorded and the recordings are kept for the agreed period. Customers and sites can review them.
- Site connectors make outbound connections only; nothing at a customer's site listens for connections from the internet.
- Accounts for contractors expire automatically at the end of their work.
Our infrastructure
Our access gateways are in secure data centres in the United Kingdom and New Jersey, in space we control, with physical access limited to named people. Gateways are built from a hardened standard configuration, patched monthly and immediately for critical vulnerabilities, and monitored at all times. Administrative access to our own systems is only from managed devices and requires a hardware key.
Staff
All staff and contractors with access to customer systems are screened before they start, sign confidentiality undertakings and complete security training every year. Access is reviewed every quarter and removed on the day someone leaves.
Reporting a vulnerability
If you believe you have found a security vulnerability in our services or this website, please email security@halsworth.uk with enough detail for us to reproduce it. We will acknowledge your report within two working days and keep you informed. Please do not access data that is not yours, disrupt our services or our customers' equipment, or disclose the issue publicly before we have had a reasonable chance to fix it. Our contact details for security reports are also published at /.well-known/security.txt.