Security & Data Practices

Protecting your website and data is part of every project we take on. Here’s how we handle security for the sites we build and manage.

Hosting and infrastructure
Client sites are hosted on WPMU DEV managed WordPress hosting, which holds an independent SOC 2 Type II attestation. Every site is served over HTTPS, and administrative file access uses encrypted SFTP/SSH connections.

Backups and recovery
Sites are backed up automatically every night. Backups are encrypted, stored off-site, and kept for 30 days, so a site can be restored quickly if something goes wrong. Hourly backups are available for sites that need them.

Access and authentication
Access to client sites is limited to 4621 Creative Solutions and the people each client authorizes. Our hosting dashboard is protected by two-factor authentication, and we can enable or require it on your site’s login.

Monitoring and maintenance
Sites are scanned for malware and vulnerabilities, and WordPress core, themes and plugins are kept up to date.

Incident response
We follow a documented incident response plan. If a security incident affects your site or data, we will notify your designated contact within 48 hours, and once it is resolved we provide a written report. Our full incident response plan is available to clients on request.

Your data
Your website and its data belong to you. If you ever end our relationship, we will provide a complete export of your site and data, or transfer it to a host of your choice.

Report a security concern
Email aric.harris@4621creative.com or call (650) 787-4113.