How ClaimSave UK protects consumer information.
We use layered technical and organisational controls designed to reduce the risk of unauthorised access, loss, alteration or disclosure.
Access control
Staff access is role-based. Customer-facing operational roles can access records needed for their work; IT accounts are intentionally restricted from routine consumer data; administrator permissions are separated from the overall owner role; and affiliate partners use separate accounts for their own company information.
Authentication
Passwords are stored using salted one-way password hashing. Newly provisioned accounts must replace their temporary password on first sign-in. Strong password rules, login throttling and temporary lockouts are applied to staff and affiliate sign-in attempts.
Sessions and browser security
Authenticated sessions use random server-side tokens, expiry times, HttpOnly cookies, SameSite protections and CSRF tokens. Production deployments are configured for Secure cookies over HTTPS. The application sends restrictive Content Security Policy, anti-framing, content-type, referrer and browser-permission headers.
Documents and uploads
New customer uploads are restricted to approved document/image types and size limits. Uploaded files are given random object keys, encrypted with application-level AES-256-GCM authenticated encryption before storage, and kept in private S3-compatible object storage in production. Authorised CRM or partner downloads are retrieved and decrypted only after the existing access checks succeed.
Audit and accountability
Important sign-in, account, affiliate, claim and administrative events are recorded in audit logs so access and changes can be investigated. Access should be reviewed regularly and accounts disabled promptly when no longer required.
Infrastructure controls
The live host must use HTTPS/TLS, protected backups, operating-system and dependency patching, restricted database/storage permissions, firewalling and monitored server access. These hosting controls are part of the production security design and must be maintained by the operator.
AI webchat security
The customer webchat uses server-side session tokens, request throttling and limited message lengths. AI provider credentials remain on the server and are not sent to the browser. The assistant is instructed not to request passwords, portal PINs, bank/card details or identity documents and provides a human-handover route where needed.
Data minimisation and sharing
Consumer information should only be collected where necessary and should only be shared with an affiliate where there is an appropriate purpose and lawful basis. Affiliate company and regulatory information is separated from consumer access credentials.
Important limitation
No online service can promise absolute security. Controls must be reviewed, tested and improved as risks, technology and the service change. Security incidents should be handled under a documented incident-response and data-breach process.