Data Security

1. Isolated workspaces

Every workspace runs with its own separate database and its own file storage. Your data is never mixed with another customer's data, and one customer cannot reach another customer's workspace.

2. Encryption

• All traffic to our website, panels, apps and hosted products is encrypted with HTTPS (TLS).
• User passwords are stored only as secure one-way hashes and cannot be read by anyone, including our staff.
• Server, database and integration credentials are encrypted at rest.
• Mobile app access uses tokens that expire and can be revoked at any time.

3. Access control

• Our staff receive access only to what their role requires, through role-based permissions.
• Administrative access to servers and databases is restricted to authorised personnel.
• Staff access to customer workspaces happens only for support, maintenance or security, and is recorded.
• Inside your workspace, you control your users and what each role can do.

4. Infrastructure and maintenance

• Products are hosted on managed servers protected by firewalls.
• We apply security updates to servers and software regularly.
• Payments are processed through established payment gateways; card details do not pass through or stay on our servers.

5. Backups and recovery

Workspace databases and files are backed up regularly and backups are kept for a limited period before being rotated out. If data is lost because of a fault on our side, we will restore it from the most recent available backup.

6. Monitoring and incident response

We monitor our systems for unusual activity and errors. If we confirm a security incident that affects your data, we will notify you without undue delay, and no later than 72 hours after confirming it, with what happened, what data was affected and what we are doing about it.

7. Partners

Partners (resellers) who sell PXSystems products must follow these security standards. Partners can manage accounts and billing for their customers, but cannot access workspace data unless the customer gives them access.

8. Data deletion

When a subscription ends and the retention period described in our Privacy Policy has passed, the workspace database and files are permanently deleted. Deleted data is removed from backups as those backups expire.

9. Your responsibilities

Security is shared. We ask you to:

• use strong, unique passwords and never share your login;
• give each person their own user account with only the access they need;
• remove users promptly when they leave your organisation;
• keep control of your own domain and DNS settings;
• contact us immediately if you suspect unauthorised access.

10. Reporting a security issue

If you believe you have found a security vulnerability in any PXSystems service, please report it to support@pxsystems.com. Please give us reasonable time to fix it before sharing it publicly. We do not take action against people who report issues in good faith.