Last reviewed: 07/09/2026
Our commitment
Protecting the information entrusted to us — by our supporters, research participants, the people we advocate for, volunteers, and staff — is a core responsibility of Community Voices Matter. Our trustees take overall responsibility for information security, supported by our Senior Data and Impact Lead.
Our approach
We follow recognised principles of information security — protecting the confidentiality, integrity, and availability of personal and organisational information. In practice this includes:
- Access controls. Staff and volunteers only have access to the information they need to do their role. Access is reviewed regularly and removed promptly when no longer needed.
- Authentication. Strong passwords and multi-factor authentication are required for systems holding personal data.
- Encryption. Personal data is encrypted in transit (using TLS) and at rest in our main systems.
- Trusted suppliers. We carry out due diligence on the providers who handle data on our behalf, and require them to meet appropriate security standards through written contracts.
- Staff and volunteer training. Everyone with access to personal data receives data protection and information security training as part of induction and at regular intervals.
- Backups and resilience. Critical data is backed up regularly and we test our ability to restore it.
- Incident response. We have a documented process for identifying, containing, and reporting security incidents, including notifying the ICO and affected individuals where required by law.
- Continual improvement. We review our security arrangements regularly, including after any incident or significant change to our systems.
Standards and certifications
We align our practices with UK government guidance from the National Cyber Security Centre and the Information Commissioner’s Office.
Reporting a security concern
If you believe your information may have been compromised, or if you have discovered a vulnerability in our website or services, please contact us at info@hwnn.co.uk. We take all reports seriously and will respond promptly. We are grateful to security researchers who disclose issues to us responsibly.
A note on limitations
No organisation can guarantee absolute security. Our commitment is to take reasonable, proportionate steps appropriate to the sensitivity of the information we hold, to respond quickly when problems arise, and to be transparent with the people affected.