Retrofit Design Pro
Trust & Security

Built to protect the retrofit data your clients trust you with.

Retrofit Design Pro is designed around the PAS 2035:2023 retrofit process — and the data inside (property addresses, EPC ratings, surveyor reports, funded-measure information) deserves the same care as the buildings it describes. Here's exactly how we handle it.

UK-resident dataEncryption in transit & at restMFA availableBcrypt password hashing

Our commitments

Six commitments that govern how we build, deploy, and operate the platform.

Strong authentication

Passwords are stored with bcrypt (adaptive cost) — never in plaintext. Sessions use signed JWTs over HTTPS-only, SameSite cookies. Multi-factor authentication is available for every user (TOTP authenticator app OR email one-time code).

Encryption everywhere

All traffic uses TLS 1.2+ (HSTS pinned). Database connections run over TLS. Exported PDFs are AES-256 encrypted before download. Secrets live only in environment variables — never in source code.

Strict data scoping

Every project, file, and design version is hard-scoped to its owning user at the database query level. There is no shared tenant — only an owner-or-admin filter. Admin access is logged and policy-controlled.

Defence-in-depth

Defensive HTTP headers on every response (HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff, strict referrer policy). Uploaded files are MIME-verified by magic bytes — not by user-supplied headers — to block stored-XSS payloads.

Hardened against abuse

Brute-force protection on every authentication endpoint. Failed MFA attempts burn the challenge after a small number of tries. XML uploads are parsed with a dedicated, XXE-safe parser (defusedxml). Email-enumeration paths neutralised.

Standards-aligned content

The platform's AI assistance is rule-bound to cite ONLY the current, non-superseded versions of UK standards (PAS 2035:2023, PAS 2030:2023, BS 5250:2021, BS EN ISO 13788:2012, etc.). A response-layer rewriter catches any slip-through before it reaches a designer.

Your data

We hold what's needed for the design — and nothing extra.

What we store
Project metadata (name, address, EPC ratings), measure specifications, uploaded supporting documents (RdSAP XML, technical surveys, floor plans, installer photos), user-authored notes, and the generated design pack PDF.
What we never store
Resident bank or payment details. National Insurance numbers. Information not required by PAS 2035:2023. Plaintext passwords. Recovery codes in reversible form.
Where it lives
Production data is hosted within the UK / EU region of our cloud provider. MongoDB stores documents in encrypted-at-rest volumes. Backups follow the same encryption posture.
How long we keep it
You retain your projects for as long as your account is active. When you delete a project it is permanently removed from the live database; backups roll off on a 30-day window.
Who can see it
Only you and any teammates you explicitly add. Platform administrators can access your data only when responding to a written support request, and that access is logged in our audit trail.

For procurement

Common questions from RFPs, answered in plain English.

Is the platform PAS 2035:2023 compliant?▼
The platform is purpose-built for PAS 2035:2023 retrofit design and generates outputs aligned with PAS 2035 Annex B requirements (risk and improvement options analysis, ventilation strategy, moisture management via BS 5250:2021 / BS EN ISO 13788:2012). Compliance of any individual project remains the responsibility of the assigned Retrofit Coordinator and Retrofit Designer.
What encryption is in use?▼
TLS 1.2+ in transit (HSTS pinned), encryption at rest for the database and backups, and AES-256 encryption applied to generated PDF design packs before download.
Do you offer multi-factor authentication?▼
Yes — TOTP authenticator app (Google Authenticator, 1Password, Authy) or email one-time codes. Administrators can require MFA across an organisation. Recovery codes are bcrypt-hashed; not stored in reversible form.
How do you handle a data breach?▼
We follow the UK GDPR / DPA 2018 72-hour breach notification window. Affected customers and the ICO are notified within that window if the incident materially affects personal data. Our incident-response playbook covers containment, customer notification, root-cause analysis, and post-incident hardening.
Can I export or delete my data?▼
Yes — every project can be exported as a PDF design pack, plus a branded PDF summary and letters. To delete an account or specific project, emailsupport@retrofitdesignpro.co.ukfrom the registered address. We action verified requests within 7 working days.
Do you use customer data to train AI models?▼
No. The AI features in the platform call third-party LLMs (Anthropic Claude, Google Gemini) under no-training agreements — your project content is processed by the model only to generate that specific output and is not retained by the model provider.

Responsible disclosure

Found a security issue? We'd like to hear about it before anyone else does.

If you've identified a vulnerability in the platform, please report it privately to the address below. We commit to acknowledging your report within two working days, keeping you updated through investigation, and crediting your finding (with your permission) once the fix has shipped.

security@retrofitdesignpro.co.uk
Please do
  • • Give us reasonable time to fix before public disclosure
  • • Avoid privacy violations — use test accounts
  • • Provide reproduction steps where possible
Please don't
  • • Run automated scans that disrupt the service
  • • Access or modify another user's data
  • • Demand payment as a condition of disclosure