Security

Data protection

We use industry-standard measures to protect personal and business data in transit and at rest, including encryption where appropriate, access controls and monitoring.

Infrastructure

Our services run on reputable cloud infrastructure with encryption, backups and restricted administrative access. Website forms and leads may be processed by vetted providers (for example form delivery and cloud databases) under our instructions. We separate environments where practical and limit production access to staff who need it.

Access control

You control who can access your Plutoo Garage account. Use strong unique passwords and limit access to trusted staff only. Internally we follow least-privilege access, authenticate administrators, and review access when roles change.

Breach response

We maintain processes to detect, investigate and contain security incidents. If a personal data breach is likely to result in a risk to individuals, we will notify the ICO where we are the controller, without undue delay and where feasible within 72 hours of becoming aware.

Where we process data as a processor for customers, we will notify the affected customer without undue delay so they can meet their own obligations. More detail is in our DPA summary.

Processors and transfers

We use third-party processors for hosting, email, spam protection, AI chat replies and (if you consent) analytics and fonts delivery. Details are listed in our Privacy Policy and Cookie Policy.

Reporting issues

If you believe you have found a security issue, contact [email protected] so we can investigate promptly.