Security
Security at Data in Hand
Last updated 29 October 2026.
How our business software is built
- Your data stays with you. Site Survey and Asset Register and Project Delivery Hub run in your own Microsoft 365, installed by your IT team. Data in Hand holds no copies of your projects or surveys and has no access to them.
- Least privilege. By default the apps ask only for the SharePoint site your IT team grants them, people's names and email addresses, and features' own permissions when someone first uses them. Every permission is delegated: the app can't do more than the signed-in person.
- No tracking. The apps contact nothing outside your organisation unless your IT team turns on the optional update check or AI assistant (which uses your own Azure OpenAI).
- Reviewable. The Team edition is supplied as readable code, with a software bill of materials, file checksums and a strict content security policy.
- Guests only if you already have them. Project Delivery Hub only shares with people already in your Microsoft 365 and never invites anyone new.
Our Data in Hand Security and Data Protection Statement (one statement for all our apps, with an appendix for each), the IT Set-up Guides and our completed security questionnaire are in our supplier security pack: ask support@datainhand.co.uk.
Reporting a security problem
If you think you've found a security problem in our software or this website, email security@datainhand.co.uk. Please give enough detail for us to reproduce it, and don't access or change other people's data, disrupt the service or publish the problem before it's fixed.
- We'll acknowledge your report within 2 working days and keep you updated until it's fixed.
- We won't take legal action against anyone who reports in good faith and follows this policy.
- We'll credit you when the fix is released, if you'd like.
How quickly we fix problems
| Severity | Fixed and released within |
|---|---|
| Critical: someone outside a customer could read or change their data | 7 days, with customers told within 1 working day |
| High: a signed-in user could get round their access level | 30 days |
| Medium: a weakness that needs unusual conditions to exploit | 90 days |
| Low: hardening and best practice | The next planned release |
Severity is judged with the Common Vulnerability Scoring System (CVSS). The third-party components in our apps are checked monthly. Every release is listed on What's new.