How we keep your website and your data safe

ThenMedia Limited, the company behind Parish Council Pigeon, is Cyber Essentials certified. Security, backups and software updates are handled as part of your monthly fee, so there is nothing for your council to set up, monitor or renew.

Our credentials

What Cyber Essentials actually means

Cyber Essentials is a certification backed by the UK government. It covers five basic areas that between them stop the great majority of everyday online problems, and it applies to the whole of ThenMedia rather than to one server or one service.

It is assessed independently rather than self-declared, and it has to be renewed every year, so it cannot quietly go out of date. Many public sector bodies now ask their suppliers to hold it.

It is not a promise that nothing will ever go wrong. What it shows is that the fundamentals are in place, and that somebody outside the company has checked them.

 Firewalls only the connections a website genuinely needs are allowed in

 Secure settings systems are set up deliberately, not left as they came

 Access control people can reach only what their job actually requires

 Malware protection servers and computers are protected against malicious software

 Keeping software updated security updates are applied promptly, not when somebody remembers

Your website’s own security

The part your council sees day to day is the login to your own website. A few things are true of every Parish Council Pigeon site.

• Passwords must be at least 12 characters long, with no upper limit, and a password you have used before cannot be used again.
• If someone tries to find a password by guessing repeatedly, the account locks itself before they get anywhere.
• Only we can create accounts. There is no public sign-up, so nobody can add themselves to your site.
• If a login is ever compromised, tell us and we will reset it the same day.

How your website is backed up

Your website content and records are copied every day to separate, secure storage kept well away from the live server, on drives arranged so that the failure of a single disk is very unlikely to cause a loss. Images, documents and other uploaded files are backed up on their own schedule within the hosting platform.

Those copies are not kept for a week and then thrown away. Daily backups are kept for a month, then weekly copies for three months, then monthly copies for five years, and yearly copies after that.

The retention is the part worth understanding. If a document is deleted or changed by mistake and nobody notices for some time, it can often still be recovered. Councils and organisations that have to keep records for years benefit from this without having to do anything themselves.

Like every hosting provider, we cannot guarantee that a backup will exist or be recoverable in every circumstance, so we cannot promise that data could never be lost. Our systems are designed to make that very unlikely. We recommend your council also keeps its own copies of important documents, such as minutes, policies and accounts.

Where your data lives

Your website is hosted in Google Cloud Platform’s London region, so your data is held in the United Kingdom. That region also runs on a high proportion of renewable energy, which was part of why we chose it.

ThenMedia Limited is a UK company, registered in England and Wales under company number 07990449, and your support comes from the UK, from the people who built your site.

If you ever leave us, your content is yours. We will export your content and files for you, and remove your data from our systems when you ask. The content management system itself, and the cloud data system that holds your website, remain the property of ThenMedia and are leased to you as part of your hosting, so they do not leave with you.

Accessibility and compliance

Security is one part of running a council website properly. Accessibility and your publishing duties are the others, and they are covered in full elsewhere on this site rather than repeated here.

• How we build and test for accessibility, to the standard the public sector regulations require
• How we handle compliance, from the Transparency Code to agendas, minutes and policies
• Our privacy policy, which sets out how ThenMedia handles personal data

Common questions