ISO 27001
Working toward a certification audit. No certificate has been issued.
Trust centre
How we look after security and privacy
This page lists the controls we can show today, how often we check them, and which role owns each one.
Updated 16 October 2026
ICO registration
50heads Limited is registered with the Information Commissioner's Office. The registration number is ZC262700.
Where the audits stand
We are working toward ISO 27001 and SOC 2 Type 2. No certificate and no examination report have been issued.
SOC 2 Type 2
Working toward an examination. No report has been issued.
Controls we can show
A control appears here only when its evidence is still in date and the Security Owner has signed the wording off. Anything we cannot show yet is left off this page.
No 50heads password
People sign in with Apple, Google, or a one-time email code. There is no 50heads password to reuse.
How often: Always on. The wording is reviewed when the security page changes.
Owner: Engineering lead
Sessions stay on the device
The website keeps the session in a secure, HTTP-only cookie. In the app, the access token is bound to the device that signed in.
How often: Always on. The wording is reviewed when the security page changes.
Owner: Engineering lead
API keys are stored as hashes
API keys are stored only as hashes, shown once, and limited to the access they were given. A request that arrives with a browser origin header is refused.
How often: Always on. The wording is reviewed when the security page changes.
Owner: Engineering lead
Card and bank numbers stay with the payment companies
Card payments and payouts go through regulated payment providers, Stripe and Wise. We do not store full card or bank numbers.
How often: Always on. The wording is reviewed when the security page changes.
Owner: Engineering lead
Data is encrypted on the way and in storage
Connections are encrypted in transit, and stored data is encrypted at rest. The data processing agreement is the contract for those measures.
How often: Always on. The wording is reviewed when the security page or the data processing agreement changes.
Owner: Engineering lead
Uploads are checked before anyone sees them
Uploads are checked for type and size. Image metadata, such as location, is removed. Images are screened before the people answering see them.
How often: Always on. The wording is reviewed when the security page changes.
Owner: Engineering lead
Staff actions are written down
Staff actions in the admin tools are written to an audit log. A row in that log cannot be edited.
How often: Always on. Reviewed with the security page and the logging record.
Owner: Security Owner
Tell us about a vulnerability
Use the contact form and choose Security. We will reply to every report.
How often: Always on. The wording is reviewed when the security page changes.
Owner: Security Owner
Where data is stored
Our own database and stored files are hosted on Cloudflare. A capture on 7 October 2026 placed that primary database and the file storage in the eastern United States. An EU-only storage setting was not turned on. The service is also served from Cloudflare's global network. Transfers outside the UK or the EU are described in the data processing agreement.
Companies that process data for us
The companies that process personal data for 50heads are listed on the subprocessors page, with what each one does and the location it states. We give at least 30 days' notice before adding a company that handles personal data.
Report a vulnerability
Use the contact form and choose Security. We will reply to every report. The security page sets out the scope and what we promise researchers who act in good faith.
Ask for documents under NDA
Customers and their advisers can ask for a fuller security pack under a non-disclosure agreement. Use the contact form and choose Legal. We do not publish audit reports we do not have.
Ask for the security pack
We send documents under a non-disclosure agreement. To report a vulnerability, use the contact form and choose Security.