Global B2B Group applies technical and organisational measures appropriate to the risk of the personal and commercial data processed through the Platform. This document summarises the current controls. It is an app-owner statement and is not a certification.
1. Encryption
- All web traffic served over HTTPS with modern TLS (1.2+; 1.3 preferred).
- Stored data encrypted at rest by the underlying database and object-storage providers.
- Secrets and API keys held in a managed secret store and rotated where feasible.
2. Access control
- Role-based access control across admin, workspace and public surfaces.
- Row-level security enforced on tables containing user and RFQ data.
- Two-factor authentication available for administrator accounts.
- Least-privilege access; joiner / mover / leaver reviews.
3. Application security
- Input validation and parameterised queries on all data paths.
- Output encoding, CSP, HSTS, X-Frame-Options and other standard HTTP security headers where applicable.
- Regular dependency updates and automated security scanning of the codebase.
- Rate-limiting and abuse controls on public forms and endpoints.
4. Infrastructure
- Hosting on managed edge / CDN infrastructure with DDoS protection and web-application-firewall features.
- Backups performed by the managed database provider.
- Logging and monitoring of key application and infrastructure events.
5. Vendor management
Sub-processors are selected for security posture and documented in the Third-Party Services Disclaimer. Data-processing agreements are in place where required by law.
6. Incident response
Global B2B Group maintains a documented incident-response procedure covering triage, containment, forensics, notification and post-incident review. Where a personal-data breach meets the notification threshold under GDPR / UK GDPR or equivalent law, affected supervisory authorities and data subjects will be notified within the prescribed timeframes.
7. Responsible disclosure
Security researchers should follow the Responsible Disclosure Policy.
8. No absolute security
No online service can guarantee absolute security. Global B2B Group aims to apply controls proportionate to the risk and to continuously improve them, but does not warrant that the Platform will be uninterrupted, error-free or completely secure.
9. Contact
Security: security@globalb2bgroup.com.