1. Security review and testing
Between 20 and 29 September 2026 the whole platform was reviewed from a security-first perspective, area by area, before any automated release process was switched on. Every area is complete, and every issue found was fixed before the review closed.
1.1 The review covered 27 areas, including:
- Accounts and access: sign-in, sessions, passwords, administrator access and least-privilege permissions.
- The application: every form and request, input limits, error handling, and refusal of forged requests sent from other websites.
- Outside content: every website, record and document an assessment reads is treated as untrusted, including any attempt to manipulate the written summary of a result.
- Data: database security, separation between customer accounts, file handling and retention.
- Infrastructure: hosting and cloud configuration, secrets and credentials, and resilience against floods of traffic.
- Software supply chain: every software package the site runs is pinned to an exact version and verified by its cryptographic fingerprint before it is installed.
1.2 Every fix is backed by an automated test that fails if the protection is ever removed. These tests run before every release, and a release that fails any of them does not go live.
1.3 Significant security events are recorded and alert the company directly as they happen. Access to the hosting and source code accounts requires two-factor authentication.
1.4 The review was carried out by MetaAshes itself. The next step is an independent penetration test by a specialist firm; a summary of its findings will be published on this page when it is complete.
2. Encryption in transit
Issued by Google Trust Services, valid until 13 February 2027, for metaashes.co.uk. Read directly from the certificate presented to your browser at the moment this page was generated, the same way our checker reads a firm's own certificate history. It is never asserted without being checked.
2.1 Every page on this site is served only over HTTPS. An unencrypted request is never accepted.
2.2 The certificate is issued by a public certificate authority and logged in the public Certificate Transparency system, which anyone can search independently. Section 7 shows you how.
3. Account and session security
- Passwords are never stored in readable form. Each one is salted and hashed with PBKDF2-SHA256 at 600,000 iterations before it ever reaches our database.
- Your sign-in session is a randomly generated identifier held in a cookie marked HttpOnly and Secure, so it cannot be read by a script on the page or sent over an unencrypted connection, and it is revoked immediately on sign-out, a password change, or account deletion.
- A form submitted from any other website is refused. This is what stops a malicious page elsewhere from acting on your account without your knowledge.
- Repeated sign-in attempts from one address are rate limited, so a stolen password cannot be tried automatically at scale.
4. Assessment security
- Each assessment is opened with a single-use link, valid for a short window. Once it has been used, or the window has passed, it cannot be reused.
- A check is deducted from your account only at the moment the assessment actually runs, atomically, so a failed or abandoned attempt never costs you one.
- Your answers are held only for the duration of your session to produce the result. They are never written to our database; only the firm's name, website and reference numbers, the product, the verdict, the risk level and the date are kept, in your verification history.
5. Payment security
5.1 Card payments are taken on the secure hosted payment page of our provider, Fondy Ltd, so card details never reach MetaAshes' systems. This places MetaAshes within the scope of PCI DSS Self-Assessment Questionnaire A, the questionnaire for merchants that fully outsource card handling to a compliant provider.
5.2 Card and bank details are never entered on this site, and never reach our servers at all. Payment on metaashes.co.uk is made on the secure hosted payment page of our card payment provider, Fondy Ltd, registered with the Financial Conduct Authority as an electronic money institution (FRN 900705): your card details are typed into that page, not ours, and we receive back only your order's reference and the amount paid. Every payment is confirmed directly with the provider before checks are added. See our Cancellation and Refund Policy for exactly how a payment is confirmed.
6. Data handling
6.1 We collect as little personal data as we can to run this service, hold it for no longer than we need to, and never sell it or use it for advertising. The full detail, including retention periods and your rights, is in our Privacy Notice and Cookie Policy.
6.2 IP addresses used to limit repeated attempts are held in memory for no more than one hour, and only strictly necessary cookies are set: nothing tracks you between visits.
7. Verify it yourself
7.1 Every claim above is something you can check independently, not something you have to take on trust:
- The certificate: search
metaashes.co.ukat crt.sh, the public Certificate Transparency log search. - Our ICO registration: reference ZC187194, searchable at ico.org.uk.
- Our company record: number 16921717, searchable at Companies House.
7.2 If you believe you have found a genuine security issue with this site, please tell us at contact@metaashes.co.uk or through our contact form before disclosing it anywhere else, so we can resolve the issue.