Skip to content
Client sign-in Discuss your project
Trust centre

Secure communication.

Check our public encryption key, understand how enquiries are handled, and find the right channel for security questions.

Report a security issue How enquiries are handled

Secure communication

Website encryption key

Contact and careers forms encrypt their contents in your browser using this public key. The website backend does not decrypt submissions.

Download public key View security.txt

OpenPGP fingerprint

B670 A459 F6E6 5722 0163 97B6 0E96 11E2 3D24 91E3

Key ID
0x0E9611E23D2491E3
Expires
Scan with an OpenPGP app on another device and compare the fingerprint.

Security reporting

Report a weakness in our systems through our security contact. Use the public key for sensitive details.

Read the disclosure policy

Signed website release

The release manifest lists file hashes and includes a detached signature you can verify with the website public key.

Download manifest Download signature
How to check the release
  1. Obtain the public key and confirm its fingerprint through a channel you trust.
  2. Verify the detached signature against the downloaded manifest using your OpenPGP software.
  3. Compare the files from that release with the hashes in the verified manifest.

A valid signature establishes the source and integrity of the manifest. It is not an assessment of every service or a certification.

Your browser can run the check itself. It fetches the signed manifest, checks its signature with the pinned website key, then compares this page's HTML, scripts and stylesheets with the listed hashes.

Engagement documentation

Need information for a review?

Ask your engagement lead for the scoped documentation available for your project.

Discuss your project