# Security and UK hosting

Where CubeSites keeps your sites and data, how sign-in and permissions work, and how published sites are protected. UK hosted on AWS, two-step sign-in on every account.

- **Hosting:** Amazon Web Services (AWS), in the UK
- **Sign-in:** Email and password, with two-step sign-in by authenticator app
- **Passwords:** Hashed with Argon2id. Never stored or readable as plain text
- **In transit:** HTTPS for the editor, the API and every published site
- **Published sites:** Served on their own domain, apart from the editor, with no sign-in cookies
- **Integrations:** Optional, through CubeConnect, with keys stored encrypted
- **Who builds it:** Cube Systems Limited, part of Crushed Ice Group, in Olney, Buckinghamshire

## What protects your workspace

- **Hosted in the UK:** CubeSites and the sites built with it run on Amazon Web Services in the UK. Pages, images, form enquiries and account data are stored there.
- **Two-step sign-in:** Every account can add a code from an authenticator app, so a stolen password on its own is not enough. On Pro, an owner can require it for everyone.
- **Every workspace kept apart:** Every request is limited to your own workspace on the server, and automated tests check that one workspace can never reach another. Our staff console shows plans and usage, not your content.
- **Published sites stand apart:** Published sites are served from a separate domain to the editor and never carry a sign-in cookie, so a page on one site cannot act for a signed-in editor.
- **Custom code in a sandbox:** Custom code blocks and embedded content run in a sandboxed frame, cut off from the rest of the page.
- **Forms that resist spam:** Contact forms use hidden traps, timing checks and rate limits. Visitor IP addresses are kept only as a one-way hash for spam control.
- **Analytics only with consent:** Google Analytics loads only after a visitor accepts cookies. Fonts come from a service that does not track visitors.
- **Keys you control:** API tokens act with the permissions of the person who created them and can be revoked at any time. Integration keys are encrypted at rest.
- **AI on your terms:** AI only drafts for a person to accept, can be switched off for a workspace, and your content is not used to train models.

Security questions: support@cubesites.co.uk

---

CubeSites is a trading name of Cube Systems Limited, part of Crushed Ice Group. Registered in England and Wales, company number 17220899. Registered office: Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. ICO registration number ZC216972.

Contact: hello@cubesites.co.uk | 01234 672 617 | https://cubesites.co.uk/contact