Security, backups and redundancy
We're one of the few companies in the UK that are registered with the Information Commissioner's Office for data protection (registration number: ZA246885). Companies situated outside of the EU are not subject to the strict data protection laws set out for European entities but we treat all customers all over the world with the same standard as our EU customers. Our infrastructure is completely PCI DSS and HIPAA compliant which means customers can store payment and health information on our servers. Others charge for this or claim to be compliant without any kind of certification or third party audits.
Proactive security
We have a dedicated team of engineers whose sole task is to find vulnerabilities in our infrastructure, in WordPress, popular plugins, our customers websites and applications. When we find a vulnerability, we let the relevant entities know so they can release updates but since it can often take months before a patch is released by them (often leaving millions of websites vulnerable), we patch our servers and clients websites immediately to minimise risks. And since WordPress updates often break websites, our patches only target what's necessary and ensure websites remain operational after the patch so we can keep your website safe without the anxiety or reluctance of updating WordPress.
We also have a proprietary security system which prevents most forms of brute force attempts. For example, if a customer uploads a plugin that contains malware — we have mechanisms in place that will make it very difficult for someone to use the malicious plugin to take control of a website and/or perform malicious activity because of our authentication system. Every host claims to be secure but none have the technical capability to do what we do, none go to the extremes that we do to protect our clients and none have a proven track record like we do.
Common sense security
It's common now to hear companies experience breaches and data leaks and while it's impossible to be 100% secure, many have occurred through plain old negligence such as not encrypting data, allowing data access remotely for the sake of convenience and so on. They could have been prevented and while nobody can be perfect, everyone can follow common sense and to make matters worse, many of their breaches occurred in the exact same manner as other companies many years earlier yet took no action until it was too late.
As well as constantly searching for vulnerabilities in our infrastructure, we also keep abreast of the news and if we find a company has experienced a breach, we immediately and thoroughly test our systems for the same and similar types of vulnerabilities — and take action where necessary. We don't need to experience a breach to learn their lessons. We would rather be safe than sorry.
Backups and redundancy
Most companies claim to make daily backups which in reality isn't the case or their backup strategy is unreliable and customers aren't aware of this until they need it. When their customers ask to restore from a backup, they often come across failed/unusable backups or backups that do not exist. To mitigate this, we perform full backups of files and databases every 3 hours and store copies of them in so many different locations to ensure a recent copy is always available in the event of a catastrophe.
Backups are stored on the physical server in RAID (multiple disks have the same copy), a copy is stored on our local storage array network (SAN) which is a cluster of servers and disks (again, multiple drives will hold a copy on the SAN) at the other side of the data centre and a final copy is sent to Amazon S3 with geo-redundant replication. To date, we have not lost a backup. No other host can do or offer this without charging thousands of pounds per month for the backups alone.
Joe Lenihan
Next Level Personal Trainer