Current service position
The public website is static and does not collect enquiries through web forms or load analytics, advertising or third-party media. The live CV Builder is hosted through Google Apps Script and uses Google Workspace-linked services.
Current organisational controls
The approved policy framework requires restricted access, strong passwords, organisation-controlled storage, secure handling, appropriate backup and prompt incident reporting. These are policy requirements and are not presented as an independent certification.
Account separation
info@thehwbco.com is the main public administration route. public@thehwbco.com is used for application and technical operations. safeguarding@thehwbco.com is a separate safeguarding route.
Cyber Essentials status
The Hwb Collective is not presented as Cyber Essentials or Cyber Essentials Plus certified. Readiness work should cover the scheme's core control areas, including firewalls, secure configuration, security updates, user access and malware protection.
Security testing status
No independent penetration test or external security audit is claimed. Testing should be proportionate to risk and scale, particularly before multi-council or higher-volume use.
Reporting a security concern
Technical security concerns can be reported to public@thehwbco.com. Do not send passwords, full CV records or unnecessary personal information in an initial report. Safeguarding concerns must use the separate safeguarding route.