Security
Security built into how Ubrix works.
Customer, site and contractor data, held on modern cloud infrastructure.
Housebuilders and contractors trust Ubrix with sensitive data: customer details, site activity and contractor coordination. The platform runs on modern cloud infrastructure, with security practices that match how the team works every day.
Certifications and alignments
Standards we hold and align to.
Cyber Essentials certified
Ubrix has held Cyber Essentials certification for the whole organisation since 10 April 2026, assessed by IASME through Bulletproof, covering the five core technical controls that protect against the most common internet-based threats.
Certificate number 2cb48456-ab0e-498a-aa46-606dd725ef9f
UK GDPR aligned
Ubrix operates in line with the UK GDPR and the Data Protection Act 2018. Personal data is processed lawfully, fairly and transparently.
ICO registration on file
Hosted in the UK
Ubrix runs on Microsoft Azure in the UK, so customer data stays in the UK unless explicitly agreed otherwise.
Operational security
How we protect your data.
Security is not a bolt-on. It runs through how the platform is built, deployed and maintained every day.
-
Encryption in transit and at rest
All data moving between the user and Ubrix is encrypted using TLS. Data at rest in Azure is encrypted using industry-standard AES-256 encryption.
-
Role-based access control
Every user sees only the data relevant to their role inside their organisation, with permissions controlled at the account, project and record level.
-
Each customer's data kept separate
Ubrix runs as one shared platform. Every record carries the customer's ID and every read and write is filtered by it, with automated tests for this, so one customer's data cannot be returned to another. Files are stored in each customer's own folder.
-
Modern authentication
Ubrix uses Microsoft Entra External ID for sign-in, with a one-time code sent by email as a second step for every customer. Single sign-on with your own identity provider is on the roadmap.
-
Monitoring and alerts
Automated uptime checks alert the Ubrix team, including outside working hours, if the platform goes down. Database activity is audited and checked for threats.
-
Regular patching
Application dependencies and underlying infrastructure are kept current, with security patches applied on a rolling basis rather than on a delayed cycle.
-
Backups and disaster recovery
The database is backed up automatically, with point-in-time restore for 35 days and backups copied to a second UK region. Files are stored as three copies, and deleted files can be recovered for 7 days.
-
Least-privilege access for staff
Access to customer data by the Ubrix team is restricted to what is strictly required for support, and all such access is logged.
Data handling and privacy
Your data, handled properly.
Where your data lives
Customer data is stored in the Microsoft Azure UK West region (Cardiff), with database backups copied to UK South (London). Data is not transferred outside the UK without explicit customer agreement, and sub-processor relationships are documented and available on request.
Who can see your data
Customer data is visible only to users in the customer's own organisation and to a small number of Ubrix staff who may need short, scoped access for support. All staff access is logged. Ubrix does not sell, share or use customer data for any purpose outside delivering the service.
How long we keep it
Customer data is kept for the length of the contract and for a defined period afterwards, as set out in the service agreement. Customers can request export or deletion of their data in line with their contract and their rights under the UK GDPR.
What you can request
Customers and their end users can request access to the personal data Ubrix holds about them, ask for inaccurate data to be corrected, request deletion subject to legal and contractual obligations, and raise concerns directly with the team. Full details are in our Privacy Policy.
Responsible disclosure
Found a security issue?
We take security reports seriously and welcome responsible disclosure. If you believe you have found a vulnerability in the platform, contact the team directly.
Questions
Common security questions.
Is Ubrix SOC 2 or ISO 27001 certified?
Ubrix is not currently certified against SOC 2 or ISO 27001, but operates many of the same underlying controls as part of its Cyber Essentials certification and day-to-day practices. Formal certification against one or both standards is on the roadmap as the business scales.
Is Ubrix accessible?
Everything across the Ubrix platform and apps is designed to WCAG 2.2 AA.
Can you complete our security questionnaire?
The Ubrix team is happy to complete standard customer security questionnaires as part of a procurement process, and typically responds within five working days.
Do you support single sign-on?
Not yet. Sign-in uses email and password with a one-time code sent by email. Single sign-on with your own Microsoft Entra or SAML identity provider is on the roadmap.
Do you carry out penetration testing?
Our team carries out regular internal security reviews of the code and configuration. An independent penetration test can be commissioned on request as part of an enterprise agreement.
Where can I find your Data Processing Addendum?
The standard Ubrix Data Processing Addendum is available on request and is signed as part of the contracting process for customers who require one.
What uptime do you commit to?
Ubrix commits to 99.5% platform uptime, measured monthly and excluding scheduled maintenance windows that are announced in advance. The platform runs on Microsoft Azure, with automated uptime checks that alert the Ubrix team if anything goes down.
How is our data protected day to day?
Data is encrypted in transit and at rest, hosted in Microsoft Azure UK data centres and backed up automatically. Access by the Ubrix team is restricted to what is strictly required for support and is logged. The platform aligns to UK GDPR and our day-to-day controls map to the Cyber Essentials framework, with SOC 2 and ISO 27001 on the roadmap as the business scales.
need more for procurement?
We answer questions, complete questionnaires and share documentation under NDA.
Prefer the phone? 0191 716 6373 info@ubrix.co.uk