Trust and Security

Priority Pixels (Holdings) Limited, registered in England and Wales under company number 11831204. VAT registration number 318369189.

Our registered office address is in the footer of every page and on the Companies House record.

Every part of the work is done in-house by our own UK team across design, development, content, SEO and paid media. We do not subcontract or outsource any of it. The team works together from our office four days a week. You deal with the people doing the work and every account has a named service lead who answers for it.

This is the full list of what we hold. If a certification is not listed here, we do not hold it.

• Cyber Essentials, whole organisation, certified 12 August 2026 with recertification due 12 August 2027
• ICO registration ZB845765 as a UK data controller
• Google Partner, certified across Search, Display, Video, Shopping and Measurement
• Good Business Charter accreditation for fair pay and responsible practice
• Accredited Living Wage Employer
• Signatory to the Mindful Employer Charter
• Signatory to the Armed Forces Covenant
• Hosting verified as green by the Green Web Foundation

The UK data centre our client websites are hosted in is independently certified to ISO 27001, ISO 20000 and ISO 14001. Those certifications belong to the data centre, not to Priority Pixels.

We design and build to WCAG 2.2 AA as a minimum. Accessibility is part of the design brief from the wireframes, so it is not a compromise made at the end of a project.

• Colour contrast tested against WCAG during design
• Keyboard operability and visible focus indicators on every interactive element
• Semantic HTML with a logical heading hierarchy
• Form fields with proper labels and clear error messages
• Typography that stays readable when text is magnified to 200%
• Manual testing with screen readers alongside automated scans with axe and WAVE

For an audit you get a severity ranked issue register, remediation estimates, findings mapped to the accessibility statement the Public Sector Bodies Accessibility Regulations require and a second audit free of charge once remediation is delivered.

We are a data controller for our own contacts and act on your behalf for any personal data we handle as part of your project. We operate in line with UK GDPR and the Data Protection Act 2018.

• Lawful bases: performance of a contract, legitimate interests, legal obligations and consent
• We do not transfer personal data outside the European Economic Area
• Client websites are hosted in a UK data centre
• Requests to exercise data rights are answered within one month
• Where personal data you control is affected by an incident, we tell you without undue delay so you can meet your own reporting obligations

Our AI workflows run behind a human review step. Nothing is published to a client channel and nothing is changed on a live account without a person signing it off. Full detail is on our AI workflows page.

The controls below are stated as facts you can check against our Security Pack.

• Client credentials held in Keeper, our enterprise password manager, on individual named accounts
• Multi factor authentication wherever a system supports it
• Access granted on director approval and revoked when someone leaves, with shared client credentials rotated as part of a documented joiners and leavers process
• High risk and critical patches applied within 14 days, with critical zero day issues addressed on the day
• Operating system security updates applied automatically
• TLS 1.2 and above enforced, host firewalls limited to the required ports and the full set of security headers applied
• Login attempts monitored and limited, with suspicious patterns blocked automatically
• Daily malware scans and file integrity monitoring on core WordPress files

Client websites run in a UK data centre with 99.995% uptime, N+N power redundancy, PCI compliant infrastructure and 100% renewable energy. Cloudflare WAF and DDoS protection are available at the edge.

Every hosted website is watched by our own monitoring platform for server health, SSL certificate expiry, cache health and infrastructure alerts. Each alert emails our development team and becomes a helpdesk ticket assigned to a developer.

The platform reads the PHP version behind every site each night, so when a security fix is released we can see straight away which sites need it. More on our website monitoring page.

• Nightly backups encrypted with AES-256 before they leave the server
• Stored offsite in Amazon S3, separately from the live environment
• 14 day retention as standard, 28 days on request
• On demand backups before any significant change
• Scheduled quarterly test restores for websites on a maintenance agreement

We hold a documented Business Continuity and Disaster Recovery Plan, available as part of our Security Pack.

Support runs through a structured ticketing process with response times set by severity.

• Urgent, such as a website offline or compromised or data at risk: response within two hours during working hours, worked until resolved
• High, where a core function is affected: response within four hours with a two working day resolution target
• Medium, a functional issue with no data at risk: response within four hours with a five working day resolution target

Our Incident Response Plan covers detection, containment, investigation, remediation and post incident review. Extended and out of hours cover can be arranged under a bespoke service level agreement.

Our Security Pack is available for procurement and security reviews. It covers:

• Security controls
• Incident Response Plan
• Business Continuity and Disaster Recovery Plan
• Supplier and Subprocessor Register
• Asset Register
• Government and Law Enforcement Data Request Policy

Our Cyber Essentials certificate and the hosting data centre’s ISO certificates are supplied with it on request.

Every reference on this page can be checked independently.

• Companies House: company number 11831204 at find-and-update.company-information.service.gov.uk
• ICO register: ZB845765 at ico.org.uk, or download our registration certificate
• Cyber Essentials: certificate 44a3b6e2-5634-4e43-877e-b5ec8ce7bfaa on the IASME registry, or download the certificate
• Green hosting: test any domain we host with the Green Web Check

If a supplier questionnaire asks something this page does not answer, email hello@prioritypixels.co.uk and we will answer it in full.