Control access by role
Start with the people who need to view, create, approve or export each record type. Keep administrative access limited and review it when someone joins, changes responsibilities or leaves. Discuss authentication and two-factor options for the applicable account setup, including recovery and administrator access.
Understand information handling
Identify personal, financial and commercially sensitive information before importing it. Agree where the service is hosted, the parties involved in processing, the access arrangements and the retention requirements that apply to your organisation. The public website’s privacy notice describes website enquiries and optional visitor features; it is not a substitute for a customer’s service agreement or data-processing terms.
Ask for evidence that matches the service
Review the available logging, export and recovery arrangements for the configuration you intend to use. Ask how incidents are reported and which events an audit record covers. Certifications, regulatory suitability, recovery objectives and service levels should be supported by evidence and an agreed commitment, rather than inferred from a module name.
Report a concern safely
Use the security and privacy enquiry option to describe an issue without sending passwords, access tokens, payment-card details or sensitive customer records. Include the affected public page, a brief description and a safe way to contact you. We can then agree an appropriate channel for any necessary technical evidence.