Trust
Security and data protection
HighwayIQ is used by public bodies to make regulatory decisions. Here is how we look after the service and the data in it.
UK hosting
The application and database run in Microsoft Azure’s UK South region. Data is stored in the UK.
Encryption
All traffic is encrypted with TLS. Data is encrypted at rest by the Azure platform.
Passwords
Passwords are hashed with Argon2id, the current recommended algorithm, and are never stored in readable form. Single sign-on with your organisation’s identity provider is planned.
Tenant isolation
Each authority is a separate tenant. Every query is scoped to the signed-in user’s tenant, and the rules are enforced in the database as well as in the application.
Access control
Each user’s role is checked against the database on every request, so removing access takes effect immediately rather than when a session expires.
Audited support access
Our own staff can reach data across tenants only through a separate, audit-logged path, for support.
Least data
HighwayIQ’s core data is public open data. The personal data we hold about users is limited to name, email address and role.
Data protection
For customer user accounts, the customer is the controller and HighwayIQ Ltd acts as processor, under a data processing agreement included in our contract. Our sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Hosting, database, application platform | UK |
| Azure Communication Services | Sending service email (alerts, digests, sign-in) | UK |
See our privacy notice for how we handle personal data on this website.
Assurance
We will complete your authority’s supplier security questionnaire and can provide architecture and data-flow documentation on request. Accreditations we hold will be listed here.
Reporting a vulnerability
If you believe you have found a security issue, email security@highwayiq.network. Please don’t test against live customer data. We will acknowledge reports within two working days.