Oxylitre Security Statement

Our website

Every page is sent over HTTPS, and your browser is told never to connect to us over an unencrypted connection. Our certificate renews automatically, so it does not lapse.

Each page also tells your browser where it may load code from. That is our own address, plus Google Analytics if you allow analytics cookies, and the Google map on our contact page. Anything else is blocked.

Our forms check every submission for spam and automated abuse before it reaches us.

The website and the service portal are hosted in the UK.

Our service portal

Our engineers, office staff and managers use the service portal at oxylitre.co.uk/portal to plan and record the servicing of medical gas equipment. Customers we have given an account use it to see their own equipment and service reports, and to send us service requests.

The connection

The portal only works over HTTPS. It loads its scripts and styles only from its own address, so no other company’s code runs on its pages. The portal is barred from using your device’s camera and microphone. The only device feature it may use is location, which records where our engineers are for their safety.

Accounts and signing in

• Each person has their own named account. Engineers, office staff, managers and the administrator each see and do only what their role needs, and a customer account sees only its own organisation.
• Passwords are stored in scrambled form (bcrypt), so nobody can read them, including us.
• Staff set their own password with a code sent to their own email address. Nobody else sees it.
• Signing in from a device the account has not used before needs a one-time code sent to the account’s email address.
• Repeated wrong passwords slow down further attempts and can lock the account against new devices.
• You are signed out after 60 minutes without use.
• Every form is protected against cross-site request forgery, where another website tries to send a form in your name.

Monitoring

The portal keeps an audit log of every sign-in and every change. Each entry is linked to the one before it, so an entry cannot be edited or removed without it showing. Our administrator receives a security summary every working day and an alert straight away for events such as an administrator signing in from a new device.

Backups

The portal is backed up every night. Each backup is encrypted with public-key encryption and AES-256-GCM, then collected by our own office systems, so the keys that unlock it are never on the web server. We test restoring from our backups.

Reviews

We review the portal’s security design before we build each major feature.

Cookies

Our website sets no cookies of its own. If you choose “Accept analytics” in the cookie banner, Google Analytics sets its cookies so we can see how the site is used. If you choose “Essential only”, it does not run. Your choice is saved in your browser, and we ask again after four months. To change it sooner, clear this site’s data in your browser and the banner will appear again.

The map on our contact page comes from Google, which may set its own cookies when the map loads.

The service portal sets only its own cookies: they keep you signed in, carry a sign-in while its emailed code is checked, and recognise devices you have signed in from before. It uses no tracking or advertising cookies.

Your data

• We keep personal data only for as long as our privacy notice says. We keep service and traceability records for 16 years. The longest service life of any of our products is 15 years, and we keep records one year longer as a margin.
• Staff details are anonymised three years after someone leaves.
• A data protection impact assessment covers the portal and is kept as a controlled document.
• If we record an engineer’s location for their safety, it is rounded to about 1 km and deleted after 72 hours. Locations are never included in our backups.
• The portal removes the location and other hidden details from each photo before it is uploaded.

How to report a security problem

If you think you have found a security problem in our website or service portal, please email quality@oxylitre.co.uk. It helps if you include:

• the page address or the part of the portal affected
• what you found and the steps to see it again
• how we can contact you

Please do not look at, change or delete data that is not yours, do not disrupt the website or the portal, and give us a reasonable time to fix the problem before you tell anyone else. We will confirm we have received your report and keep you told of progress.

Our contact details for security reports are also published in the standard format at /.well-known/security.txt.