Security
Your work, held in the UK and kept to the right people
CubeSites is hosted in the UK on Amazon Web Services. Two-step sign-in and a full export come with every plan, and permissions are checked on the server for every request.
- UK hosted on AWS
- Two-step sign-in
- Full export
- Hosting
- Amazon Web Services (AWS), in the UK
- Sign-in
- Email and password, with two-step sign-in by authenticator app
- Passwords
- Hashed with Argon2id. Never stored or readable as plain text
- In transit
- HTTPS for the editor, the API and every published site
- Published sites
- Served on their own domain, apart from the editor, with no sign-in cookies
- Integrations
- Optional, through CubeConnect, with keys stored encrypted
- Who builds it
- Cube Systems Limited, part of Crushed Ice Group, in Olney, Buckinghamshire
How it works
What protects your workspace
What is in place today, written plainly. Where something is still to come, we say so.
Hosted in the UK
CubeSites and the sites built with it run on Amazon Web Services in the UK. Pages, images, form enquiries and account data are stored there.
Two-step sign-in
Every account can add a code from an authenticator app, so a stolen password on its own is not enough. On Pro, an owner can require it for everyone.
Every workspace kept apart
Every request is limited to your own workspace on the server, and automated tests check that one workspace can never reach another. Our staff console shows plans and usage, not your content.
Published sites stand apart
Published sites are served from a separate domain to the editor and never carry a sign-in cookie, so a page on one site cannot act for a signed-in editor.
Custom code in a sandbox
Custom code blocks and embedded content run in a sandboxed frame, cut off from the rest of the page.
Forms that resist spam
Contact forms use hidden traps, timing checks and rate limits. Visitor IP addresses are kept only as a one-way hash for spam control.
Analytics only with consent
Google Analytics loads only after a visitor accepts cookies. Fonts come from a service that does not track visitors.
Keys you control
API tokens act with the permissions of the person who created them and can be revoked at any time. Integration keys are encrypted at rest.
AI on your terms
AI only drafts for a person to accept, can be switched off for a workspace, and your content is not used to train models.
Questions
Reviewing us as a supplier?
Send us your security questionnaire or your questions from your data protection lead, and a person who knows the answers will reply.
Found a vulnerability? Please report it privately to support@cubesites.co.uk, as set out in our terms of use.
Get started
Build the website your business deserves
Tell us what your site needs to do and we will tell you honestly whether CubeSites fits.