Last updated: [date]
Insight holds the trading records of RA & Olly and the retailers, publishers and partners we work with. This page explains how we protect it, and what we ask of you.
How Insight is protected
- Encrypted connections. Insight is only available over HTTPS, so information between your browser and Insight is encrypted in transit.
- Invitation-only accounts. There is no public sign-up. Accounts are created by RA & Olly. Invitation links are personal and expire after 7 days, and you set your own password.
- Passwords. Passwords are stored as one-way salted hashes, never in readable form. Our staff cannot see your password. If you forget it, use "Forgot password" to set a new one.
- Separation of accounts. Retailers see only their own orders, invoices and returns. Publishers see only their own titles, stock and sales. Every page checks this on the server, not just in the menu.
- Staff access levels. RA & Olly staff are given access levels that limit which areas they can view or change. When staff view a portal as a customer to help with a query, this is recorded.
- Logging. Sign-ins, key actions and errors are logged so problems can be traced.
- Integrations. Connections to Xero, Shopify and our email service use dedicated credentials held on the server only, never in Insight's code or pages.
- AI tools. Staff-only AI tools can read data but cannot change it. Every query they run is checked, limited and logged.
- Updates and backups. The platform and its components are kept up to date with security releases. Data is backed up [backup frequency and retention].
What we ask of you
- Use a strong password that you don't use anywhere else, and don't share your login.
- Sign out on shared computers.
- Be wary of emails asking for your Insight password. We will never ask for it.
- Tell us when someone leaves your organisation, so we can close their account.
Reporting a security concern
If you think your account has been misused, or you've found a security weakness in Insight, please email office@raandollyltd.com as soon as possible with the details. Please don't test or exploit a weakness further. We will acknowledge your report, investigate, and keep you informed.