Capitan Systems Limited
Best viewed on a device with a larger screen...
Version 2.0 — November 2026
This statement explains Capitan Systems Limited’s approach to protecting the Capitan platform and customer information. It should be read alongside your Platform Subscription Terms, Service Schedule and, where applicable, our Data Processing Agreement.
Security is a shared responsibility. We manage the platform and the infrastructure within our control. Customers remain responsible for their authorised users, devices, content, instructions and use of the services.
We use technical and organisational measures appropriate to the nature of the services, the information processed and the risks involved.
Our approach includes access restrictions, software maintenance, backup procedures and investigation of reported security issues. We review these measures as the platform and its operating requirements change.
No internet-connected service can be guaranteed completely secure. We do not represent that every attack, vulnerability, service interruption or loss of information can be prevented. This does not reduce our obligation to exercise reasonable skill and care or comply with applicable data protection law.
Capitan’s production platform is hosted on UK infrastructure. We work with hosting and other operational providers where necessary to deliver the services.
Production hosting location does not necessarily describe every processing activity associated with the services. Relevant providers and processing locations are addressed in the applicable data protection documentation.
Any use of a provider to process customer personal data on our behalf is subject to the arrangements described in the Data Processing Agreement.
Administrative access is restricted to authorised individuals who need it to operate, maintain or support the services. Access should be limited to what is necessary for the work being performed.
We may access customer installations and information where necessary to investigate faults, provide authorised support, maintain services or respond to security incidents. Personal data processed on a customer’s behalf remains subject to the customer’s documented instructions and the Data Processing Agreement.
Administrative credentials must be kept confidential and must not be shared through public or unsecured channels. Access is reviewed when responsibilities change or it is no longer required.
Customers must assign administrator accounts to identifiable users, maintain appropriate permissions and promptly remove access for people who no longer need it.
Customers and authorised users should:
Do not send passwords, complete payment-card information or unnecessary sensitive information through ordinary support messages. We will arrange an appropriate method where additional access or information is required.
Capitan’s hosted websites and administrative interfaces use HTTPS to protect information transmitted over supported connections.
HTTPS protects information in transit. It does not mean that every item of information is encrypted at rest, that every third-party connection is secure, or that a compromised device cannot expose information.
Any specific requirements for encryption at rest, key management or other additional protections must be identified and agreed as part of the service scope.
We maintain the Capitan software and the hosting components within our responsibility, including applying relevant updates and addressing identified security issues.
Changes are prioritised according to their severity, exposure, potential business impact and the practical requirements of safe deployment.
Urgent security work may require temporary restrictions, changes to functionality or maintenance without advance notice. We aim to minimise disruption and inform affected customers as soon as reasonably practicable.
Customers must not install unauthorised software, bypass platform protections or make changes that compromise the security or stability of the services.
The standard hosting environment is currently configured to create daily backups, using incremental backups between weekly full backups. These backups include website files, databases and relevant hosting configuration.
The standard backups described above are stored within the production hosting environment. They provide recovery options for some incidents but do not, on their own, provide protection against complete loss or compromise of that environment.
Additional independent backup arrangements, more frequent backups and specific retention commitments apply where expressly recorded in the customer’s Service Schedule.
Backup retention depends on the applicable configuration and service scope. Historical versions are not retained indefinitely. If you require a particular retention period, this must be agreed before you rely on it.
Backup failures reported by the backup system are notified to our technical contact for investigation.
A backup is not a permanent archive or a guarantee that every transaction or change can be recovered.
Recovery depends on the nature of an incident, the available backups, their integrity and the availability of suitable infrastructure.
We will assess the incident, take reasonable steps to protect information and work towards restoring the affected services. Restoration may involve a temporary workaround or staged recovery.
An earlier backup may not contain transactions, uploads or other changes made after it was created. A restoration may therefore require reconciliation with other available records.
We will seek to agree a restoration approach with the customer where practicable, particularly where restoring a backup could overwrite newer information.
Specific recovery-time and recovery-point commitments apply only where expressly agreed in the Service Schedule.
If we become aware of a suspected security incident, we will assess its nature and potential impact and take appropriate steps to investigate, contain and address it.
Where an incident involves personal data processed on a customer’s behalf, we will notify the customer without undue delay after becoming aware of a personal data breach, in accordance with the Data Processing Agreement.
We will provide available information and reasonable assistance to support the customer’s assessment and any required response. Information may be supplied in stages as the investigation develops.
Where Capitan acts as controller, we will assess and meet our own reporting and notification obligations.
Customers must promptly inform us of suspected unauthorised access, compromised accounts or other incidents affecting their Capitan services.
Customer information must be used only for authorised purposes and accessed only where necessary.
Customers should avoid collecting information they do not need, keep their records accurate and establish appropriate retention periods for the information they control.
Requirements involving sensitive information, special-category personal data or unusually high-risk processing must be discussed and expressly agreed before that information is introduced into the services.
The return and deletion of personal data processed on a customer’s behalf are governed by the Data Processing Agreement. Backup copies are subject to the applicable retention and deletion arrangements.
Report suspected vulnerabilities or security incidents to tech@i-capitan.com. Include the affected service, when the issue was observed and enough information for us to investigate.
Please do not include unnecessary personal data or publicly disclose information that would expose customers to an avoidable risk.
Do not attempt to access another customer’s information, disrupt services or undertake intrusive testing without our prior written authorisation.
The support hours and response arrangements in the Service Level Agreement apply unless a different incident-response arrangement has been agreed.
We review this statement when material changes to our services or security arrangements require it.
We may change individual technical measures where appropriate, provided that we continue to meet our contractual and legal obligations.
Material changes to an existing customer’s contractual commitments will be introduced through the applicable variation process. Publishing an updated statement does not, by itself, replace an existing agreement.
bespoke website build, Capitan, CRM, e-marketing, e-billing, analytics, website, London, Kensington, Bayswater