Costapp protects commercial and project information through authenticated access, project-level permissions, encrypted cloud infrastructure and documented data-protection terms. This page explains the current position without making blanket security claims.
1. Service responsibility and data ownership
COSTAPP SOFTWARE LIMITED, company number 17455845, with its registered office at 9 Regent Street, Runcorn, WA7 1LJ, England, UK, operates the Costapp website and software. Customers retain ownership of the project records, documents, correspondence and other content they enter or upload. Costapp processes customer-controlled personal data under the Data Processing Agreement and uses it only to provide, secure, support and administer the service, or as otherwise required by law.
Costapp is registered with the Information Commissioner's Office and maintains a Privacy Notice explaining its UK GDPR responsibilities.
2. Hosting and service providers
Costapp is a cloud service delivered using specialist infrastructure providers:
- OpenAI / ChatGPT Sites: application hosting or orchestration and sign-in services;
- Cloudflare: application delivery, network protection, compute, D1 database and R2 file storage;
- Stripe: subscription billing and payment processing; and
- Resend: transactional email delivery.
The complete authorised subprocessor position and change-notification commitment are set out in the Data Processing Agreement.
3. Data location and international processing
Costapp is delivered over globally distributed cloud infrastructure. Costapp does not currently offer a contractual UK-only data-residency commitment. Cloud infrastructure and provider support operations may process information outside the United Kingdom.
Where UK data-protection law requires safeguards for an international transfer, Costapp uses an applicable adequacy regulation or approved contractual measures such as the UK International Data Transfer Agreement or UK Addendum. Organisations with a mandatory data-residency requirement should contact Costapp before using the service.
4. Encryption and connection security
Costapp is served over HTTPS. Information is encrypted in transit using provider-managed TLS. Cloudflare states that the D1 database and R2 object storage used by Costapp are automatically encrypted at rest using AES-256, with keys managed within Cloudflare's key-management systems.
The service also applies browser security controls including HTTP Strict Transport Security, anti-clickjacking restrictions, content-type protection, a restrictive browser permissions policy and a controlled referrer policy.
Cloudflare's current technical information is available in its D1 security documentation and R2 security documentation.
5. Access control and customer separation
Costapp uses named authenticated accounts, organisation membership and project-level permissions. Access to a project is limited to authorised users and recipients associated with that project. Role controls restrict sensitive administration and contractual actions, and customers are responsible for removing access that is no longer required.
Shared sign-in credentials are prohibited. Users must protect their devices and sign-in access, check recipients before issuing information and report suspected unauthorised access promptly.
6. Records, monitoring and incidents
Costapp maintains application and project audit records appropriate to the service, restricts administrative access and uses infrastructure monitoring and security controls supplied by its providers. Security events are investigated under Costapp's incident procedures.
If Costapp becomes aware of a personal-data breach affecting customer personal data, it will notify the affected customer without undue delay and provide available information about the incident, likely effects and response measures, as required by the Data Processing Agreement.
7. Retention, export and recovery
Customer data is retained while the service agreement is active. At the end of the service, Costapp provides controlled export or return and deletion arrangements as described in the Privacy Notice and Data Processing Agreement. Residual protected copies may remain until securely overwritten through the ordinary infrastructure recovery cycle.
Customers should also retain or export appropriate copies of business-critical contractual records in line with their own information-management requirements.
8. Artificial intelligence and customer project data
Costapp does not submit customer project records to a generative AI model as part of the normal operation of the service. Its automated CVR narratives are produced by rules-based application logic from the figures entered by authorised users. Costapp does not use customer project content to train its own AI models.
Infrastructure providers process information only as needed to deliver and secure their contracted services, subject to the safeguards described in Costapp's legal terms.
9. Independent assurance programme
Costapp is working towards Cyber Essentials Plus and ISO/IEC 27001:2022 certification. This includes reviewing our technical controls and developing an information security management system. These are ongoing objectives, not completed assessments or guaranteed certification dates.
Current certification status: Costapp does not currently hold Cyber Essentials Plus or ISO/IEC 27001 certification. We will update this page if our status changes.
10. Security and due-diligence enquiries
Customers and prospective customers may request reasonable security, privacy or supplier due-diligence information by emailing kevin.morley@costapp.co.uk. Suspected vulnerabilities may be reported confidentially using the contact published in Costapp's security.txt file. Sensitive technical details are provided through controlled due diligence rather than published openly.