Building and hosting a very secure website

[evenflow]

Does anybody have any recommendations for a hosting company that specialises in secure websites and associated backend databases?

I'm looking for something where a client would be able to log in and store personal information, such as a driving license or national insurance number.

Edit: initially thinking AWS

Edit 2: I'd be looking to chat with a developer too...

Edited by evenflow on Saturday 11th April 13:31

[Chozza]

Its less about the hosting company and more about how you set up the servers , database etc.

With something like AWS they can provided reasonably secure platforms .. but you can easily leave your database open etc.

You should also think about why you are holding this information .. unless you've got a really good reason to require a specific piece of data i start by keeping the minimum you can.

[evenflow]

Thank you very much both for your replies and the food for thought.
Unfortunately the requirement is for storage of sensitive data so minimization isnt really an option.
I'll look into the ISO thing too.
Any recommendations of dev companies appreciated too.

[768]

Sounds like it's just some bulk personal data to think about.

I'd, perhaps naively, expect any generic software development company to be able to deal with that. Which I'd recommend would depend on the rough size of the project and budget.

[akirk]

very often the biggest issue isn't in the security of the storage - but in the processes put in place to allow you to enter / retrieve the information - no point storing data unless it can be used... giving the wrong people access / making it easy to download in bulk / etc. have been issues in the past for some companies - their data was stored very securely, but a breach at the most vulnerable point will be where the data is normally accessed legitimately...

there are many levels at which security can take place, and you need to match value of data / sensitivity / context etc. against sensible security...

so a lot of what you are looking for is not about the security in the storage element, but in how the systems are written and the business processes used to add / view data etc.

[Ynox]

I’d not be wed to AWS. And I use AWS a lot. Azure is also very good.

There’s a couple of things which are immediately coming to mind here. GDPR if it’s UK / EU site and also PCI DSS if you’re going anywhere near payments and cards (my recommendation is to use a payment processor if you can).

Security is a multilayer process and whilst not necessarily rocket science, getting it wrong can have some big Implications. So the recommendation of maybe speaking to a decent development outfit is a good one. Equal Experts are good and I know a couple of guys there.

If you’re going to do it yourself I’d get acquainted with GDPR and go from there. You may find a commercial offering which offers what you want if it’s e.g a simple form for people to enter data and securely store it.

Edit, time served developer here but I’m flat out with my day job right now!

[mikef]

OP, I guess you know this, but for that sort of personal data, you'll need to comply with GPPR - privacy by design, personal data minimisation, encryption at rest and in transmission, access control and logging, pseudonymisation, data retention policy, data subject access requests, etc.

Figure that out and it will determine your hosting options (yes, you can do all that on AWS or Azure, but your data protection policies come first)

[PSB1]

evenflow said:

Does anybody have any recommendations for a hosting company that specialises in secure websites and associated backend databases?

I'm looking for something where a client would be able to log in and store personal information, such as a driving license or national insurance number.

Edit: initially thinking AWS

Edit 2: I'd be looking to chat with a developer too...

Edited by evenflow on Saturday 11th April 13:31

Just to add to the comments already made, the key part starts with the text in bold. The risk is in looking at this purely as a technical challenge - find the right platform, find the right developer and away you go.

Your involvement, the involvement of your client and the implications for the owners of the data all together create a set of obligations and responsibilities, which you need to have at the heart of what you do.

I would suggest starting here - https://ico.org.uk/for-organisations/guide-to-data...

If you could provide a bit more context, it would help. What is the nature of your setup? Are you a freelancer, or do you own / run an organisation?