Trust Centre
A security questionnaire usually arrives after the first call, and the answers are scattered across five pages of a supplier's site. This page gathers ours so that a procurement, security or legal reviewer can get most of the way without waiting on anyone.
Everything here restates what is already published on the pages it links to, or what can be measured on this site. Where a reviewer wants a dated document rather than a web page, the request route is at the bottom and costs nothing.
Two things are deliberately absent: a list of certifications and a service-level table. We share our certification and audit status in writing during procurement, and response targets are agreed per engagement and written into the statement of work. A page that promised either would be a page you could not rely on.
Everything in one place
Each page below carries its own last-updated date. The trust page is reviewed when any of them changes.
Security
- Security and complianceData location, access, devices, code, environments, people, contracts, coverage, escalation, continuity
- security.txtWhere to report a vulnerability in this site, in the RFC 9116 format scanners read
Privacy and legal
- Privacy policyWhat this website collects, who else touches it, how long it is kept, your rights
- Cookie policyNo cookie on an ordinary page view; the third parties that load with a form
- Terms and conditionsThe terms for using this website; engagement terms live in the MSA and SOW
Accessibility
- Accessibility statementWCAG 2.2 AA as the target, what was measured, known gaps, how to report a barrier
AI on this site
- For AI agents and assistantsWhat an assistant can read and do here, and that nothing is sent without a person
What we sign and what we send
The short version of the contracts section of the security page, in the order a legal team usually asks.
Non-disclosure agreement
Yours or ours, whichever your legal team prefers, before any material changes hands.
Data-processing agreement
We sign yours or provide ours. Processing terms follow the jurisdiction you nominate in the contract.
Master agreement and statement of work
Our standard master agreement or the client's paper. The SOW names the delivery lead, the escalation contact above them, overlap hours, response targets and severity tiers.
Sub-processor list
Any third party that would touch your data, including hosting, email, analytics and AI tooling, is listed in the SOW before it is used. None is introduced mid-project without notice.
Intellectual property
Deliverables and their source code are assigned to you on final payment. Pre-existing tooling we bring is identified in the SOW and licensed to you for the deliverable.
Insurance and escrow
Professional-indemnity cover and source-code escrow are provided on request and agreed per engagement.
Assurance documents
Certification and independent-audit status in writing, and penetration-test summaries for delivered work under NDA with the client's consent.
Your security questionnaire
Answered as part of procurement at no charge. Send it through the form below or by email.
How pwtech.pw itself is run
A reviewer judges a supplier partly by its own site. These are the facts about this one, each checkable from outside or stated in the privacy policy.
Served through Cloudflare over TLS
Every request passes through Cloudflare, which handles your IP address to deliver pages and protect the site. HTTP Strict Transport Security is set for one year; frames from other sites and MIME sniffing are refused; the referrer policy is strict-origin-when-cross-origin.
Content Security Policy in report-only mode
A policy listing every script and connection origin the site uses is published in report-only mode, so violations are recorded rather than blocked. Enforcing it is a decision we have not yet taken, and we say so rather than imply otherwise.
No advertising or analytics trackers
No page loads an advertising pixel, behavioural tracker or third-party analytics. No cookie is set on an ordinary page view. Google reCAPTCHA loads on pages that carry a form, under Google's own policy.
What an enquiry becomes
Your name, contact details and message go to our team by email and WhatsApp and are kept for up to 24 months after our last contact. Your IP address is not stored with the enquiry.
The chat assistant
Answers come from the site's own page text through a model API; each question is stored for up to 12 months. The assistant does not read your browsing elsewhere and does not make decisions about you.
Files for AI agents
The plain-text index, the full-text file and the facts endpoint are generated from the same data as the pages on every deploy, behind a check that refuses any figure the site does not publish. The browser tools never submit a form.
Backups
The site database is backed up nightly and each copy is checked for completeness before older copies are rotated; a full file backup is taken weekly. Copies are kept outside the web root.
Vulnerability reports
Report a weakness in this site to [email protected]. The security.txt file carries the same address, a policy link and an expiry date so that a scanner can confirm it is current.
Due diligence, in the usual order
How a review of PWTECH tends to run, so you can plan the steps on your side.
Read this page and the security page
Most questionnaire lines are answered by the two together. Note anything missing or too thin.
Send the questionnaire
Through the form below or to [email protected]. It is answered as part of procurement, at no charge, by a named person.
Sign the NDA
Yours or ours. After this, assurance documents, audit status and penetration-test summaries can be shared.
Agree the DPA and the sub-processor list
The jurisdiction you nominate governs processing. Every third party that will touch your data is named in the SOW before work starts.
Fix the service terms in the SOW
Overlap hours, response targets by severity, the delivery lead and the escalation contact. These are the lines you hold us to.
Provision access
Named accounts in your environment, least privilege, multi-factor authentication, revoked on the day someone leaves the project. We build against sanitised or synthetic data unless you provide otherwise.
What this page does not claim
Which certifications does PWTECH hold?
This page does not list any, by design. We share our current certification and independent-audit status in writing during procurement, so what you rely on is a dated document rather than a web page that may lag behind it.
Is there a published SLA?
No. Coverage, response targets and severity tiers are agreed per engagement and written into the statement of work. A public table would either overstate what a small engagement gets or understate what a large one can have.
Is there a public status page?
Yes, for this website. Our own server checks four addresses every fifteen minutes and shows the results on the working demonstrations page, with the method beside them. It is not an independent monitor and it covers only this site. Incidents affecting a client's delivered system are handled through the escalation contacts named in that client's SOW.
Has this website been independently audited?
No. The security headers, cookies and trackers described above can be verified from outside by anyone; the accessibility statement sets out what we measured ourselves and what remains unverified.
Where does client data live during a project?
In the client's own environment and chosen region. We build and test against sanitised or synthetic data unless you explicitly provide otherwise, and project material is removed from our systems on request at the end of an engagement, with written confirmation.
Does PWTECH use AI tools on client work?
Any AI tooling that would touch your data counts as a sub-processor and is listed in the SOW before it is used, the same as hosting or email. If your policy excludes it, say so and the SOW will say so too.
Who do I contact?
[email protected] for anything on this page, including data-subject requests, accessibility barriers and vulnerability reports. We acknowledge within two business days.
Request a document or send a questionnaire
Tell us which documents you need, or attach the questionnaire to a reply when we write back. A named person answers; nothing on this page is behind a sales call.