Security, registration and certifications
Centrion holds the sign-in records, inductions, incidents and emergency rolls of regulated industrial sites, so we treat security as part of the product. This page sets out how we protect that data, where we stand on registration, the independent checks anyone can re-run, and the cybersecurity training our development team has completed. Your IT team can ask for our full security pack at sales@centrion.co.uk.
Data protection registration
Information Commissioner's Office (ICO)
Delviosolutions Limited, trading as Centrion, is registered with the ICO, the UK's data protection regulator, as a data controller and pays its data protection fee. Our entry on the ICO's public register lists Centrion by name, so anyone can check it.
UK GDPR
Each customer company is the controller of its site's data; Centrion is its processor and acts only on its instructions, under a written data processing agreement (UK GDPR Article 28). Data is stored in London, UK, and kept for 13 months on a rolling basis.
How Centrion protects your data
- Hosted in the UK (London), with every connection encrypted (HTTPS).
- Each company’s data kept apart by the database itself: every request is checked against who is signed in and their role.
- Authenticator codes (MFA) required for every admin, HSE, manager and Centrion account, enforced by the database.
- Access keys stored only as secure hashes, with limits on wrong attempts and alerts on key guessing.
- No password resets by email: lost keys and passwords are reissued by a person, after checking it really is you.
- Uploads checked on the server: only real photos (PNG, JPEG) and induction videos (MP4); anything else is deleted.
- Strict security headers: pages may only load code from Centrion itself.
- Audit log of important actions, and every data export logged and confirmed for UK-only use.
- Daily backups, kept for 7 days, with restores tested.
- Checked around the clock: our own checks every 5 minutes, plus an independent uptime monitor every 3 minutes.
- Safety first: muster and emergencies keep working with no phone signal, and never switch off over a billing issue.
- No advertising or tracking cookies.
Independent security checks
These are public scanners that anyone can run against centrion.co.uk at any time. Follow the links to see today’s result for yourself.
Security Headers by Snyk
Checks that the site sends the browser security headers that block common attacks.
Cloudflare security scan
Cloudflare’s URL scanner checks the site for malicious content and reports its security settings and certificate.
Pentest-Tools.com Website Recon
A light external scan of what an attacker could learn about the site. No critical, high or medium findings; one low, unconfirmed finding: the hosting technology (Cloudflare) can be identified. This is a reconnaissance scan, not a penetration test.
Development team certifications
Cybersecurity training and certificates earned by members of the Centrion development team. Each one can be checked with the issuer.
Certificates are held by individual members of the development team and show their training. They are not certifications of Centrion as a company. Product and company names belong to their owners.
What we’re working towards
SOC 2
Our policies and controls are being aligned with SOC 2. Centrion is not SOC 2 certified yet.
Cyber Essentials
The UK government-backed certification, once our device hardening is complete.
Independent penetration test
A test of the live platform by an outside security firm.
Report a security issue
If you think you’ve found a security problem in Centrion, please email support@centrion.co.uk with the details. We’ll reply within one working day. Please don’t test against a live customer site or access anyone else’s data.