Account and document access
The server checks the signed-in business and role before serving workspace data or uploaded documents. Customers cannot request another business’s file simply by changing its identifier. Team changes are controlled by the account owner. Removed members lose workspace access on their next request.
Sign-in and sessions
Email codes expire in 10 minutes, are single-use and stop working after five unsuccessful verification attempts. Passwords use a salted password hash. Session cookies are Secure, HttpOnly and SameSite, with an eight-hour maximum lifetime; DueSafe sessions also expire after 30 minutes of inactivity. Account owners can enable an authenticator app and save recovery codes from their account page. Once enabled, the second factor is required after either password or email-code sign-in. Email-code sign-in alone is not two-factor authentication.
Uploads and logs
Portfolio uploads are limited to PDF, PNG and JPEG, with a 2 MB limit per file and basic type-signature checks. Files receive generated identifiers and require permission checks when opened. These checks are not a malware-scanning guarantee. Access and export events are recorded without copying full tenant details into the log.
Backups and recovery
Encrypted recovery archives are stored off the hosting server in Google Drive. Verification downloads and decrypts the recovery archive, checks the database and restores files into an isolated location. This helps detect backup failures; it is not a guarantee against every outage.
Your part and reporting concerns
Use a protected email account with its own MFA, restrict team access, remove leavers promptly and keep critical compliance obligations independently checked. Send security concerns privately to info@lpcuk.uk without including passwords, full identity documents or unnecessary tenant information. See /privacy and /dpa for processing responsibilities.