Security Policy
1. Introduction
Keeping your data safe is something we take seriously at dykaw. This Security Policy sets out, in plain language, the technical and organisational measures we have in place to protect your account and personal data.
2. Our Approach to Security
We apply the principle of least privilege throughout the platform: users and administrators only have access to the data and functions they genuinely need to do their job. Security is built into how the platform works day-to-day, rather than treated as an afterthought.
3. Data Encryption
3.1 Encryption in Transit
All traffic between your browser and dykaw is encrypted using TLS (HTTPS). We do not offer an unencrypted way to use the platform.
3.2 Encryption at Rest
Data held in our database is protected using our hosting provider's storage-level encryption. As we move to our production hosting environment, we are confirming the exact encryption-at-rest configuration with that provider before go-live.
4. Password Security
Passwords are never stored in plain text. We store a one-way, salted hash of your password and cannot see or recover your actual password — if you forget it, you will need to reset it. We recommend using a unique, strong password for your dykaw account and enabling your browser or password manager's suggestions where possible.
5. Access Control
5.1 User Access
You can only see the data your account is entitled to see — for example, Standard (Talent) users cannot see other users' private details, and Pro (Agency) users only see talent made available to them through the alerts and referral system.
5.2 Admin Access
Administrator accounts are limited to trusted dykaw staff and are used only to approve, deny, or reject pending registrations and to carry out account administration. Every admin action of this kind is logged, including which administrator performed it, what the action was, and when and from where it was carried out — see Section 6.2.
5.3 Invite-Only Registration
New Standard (Talent) accounts join dykaw via invitation from an existing trusted member, limiting the platform to a genuine referral network rather than open public sign-up.
6. Monitoring & Logging
6.1 Login Attempt Monitoring
We log every login attempt made against the platform, whether successful or not, together with the IP address and browser/device information the attempt came from and the reason for any failure (for example, an unrecognised email address, an incorrect password, or a temporarily locked-out account). This lets us spot and respond to suspicious activity, such as repeated failed attempts against a single account.
6.2 Admin Action Logging
Every administrative action taken on a user account — approving, denying, or rejecting a registration — is recorded with the administrator's identity, the action taken, relevant details, the IP address it was performed from, and the date and time.
6.3 Error Logging
Application errors are logged to help us identify and fix problems quickly. Error logs are not linked to a specific person once an account is deleted (see our Privacy Policy).
7. Fraud & Abuse Prevention
Invite limits, contract-based visibility rules, and account approval workflows are all designed, in part, to prevent abuse of the referral and alerts system. Suspicious activity identified through our monitoring (Section 6) may result in an account being reviewed, restricted, or removed.
8. Backups & Disaster Recovery
Our database is backed up so that data can be restored in the event of a technical failure. As we finalise our production hosting arrangements, we are confirming backup frequency and retention with our hosting provider before go-live.
9. Third-Party Processors
We use a small number of trusted third-party services (for example, to send transactional emails) strictly to operate the platform. These providers do not use your data for their own purposes. A full list is being finalised alongside our production hosting arrangements.
10. Vulnerability Management
We review and update the platform's dependencies and code on an ongoing basis to address known security issues as they are identified.
11. Incident Response
If we become aware of a security incident affecting your personal data, we will investigate, take steps to contain and remediate it, and notify affected users and, where legally required, the Information Commissioner's Office (ICO), without undue delay.
12. Your Responsibilities
You can help keep your account secure by:
- Using a strong, unique password
- Never sharing your password or login details with anyone
- Logging out on shared or public devices
- Contacting us immediately if you suspect unauthorised access to your account
13. Changes to This Policy
We may update this Security Policy as our platform and infrastructure evolve. When we do, we will update the "Last Updated" date below.
14. Contact
If you have questions about this Security Policy, or want to report a security concern, contact security@dykaw.co.uk.