Your website, properly protected
Thousands of businesses trust Alta Ignite to keep their site online, fast and safe. Security is not an upgrade here, it ships with every plan.
Start your subscription
Our security posture, at a glance
These are not one-off upgrades you have to ask for. They are the default configuration on every Launch, Growth and Scale subscription.
Daily backups
Roll back any change in one click, retained for 90 days.
SSL and DDoS cover
Encrypted end to end and shielded at the edge.
Uptime monitoring
Alerts fire before your customers ever notice.
Patched continuously
Core, plugins and dependencies updated and tested.
Access controls
Role based logins and two factor on every account.
You own everything
Domains, code and content transfer out any time.
Infrastructure and hosting hardening
Managed, hardened hosting
Every site runs on managed edge infrastructure with regional failover rather than a single shared box. WordPress and Shopify builds sit on hosting we harden ourselves: locked file permissions, disabled file editing in the admin, blocked XML-RPC where it is not needed, and a web application firewall in front of the login and admin routes.
Isolated environments
Production, staging and preview environments are separated so a broken experiment never touches the live site. Database credentials, API keys and service tokens are scoped per environment and stored in an encrypted secrets manager, never committed to a repository.
Network segmentation
Databases and internal services are not directly reachable from the public internet. Traffic is routed through a CDN and load balancer, with origin servers only accepting connections from that layer.
Global CDN and edge caching
Static assets and, where the platform supports it, full pages are cached at edge nodes close to your visitors. This cuts load time and absorbs traffic spikes before they ever reach your origin server.
Encryption in transit and at rest
Encryption in transit
Every request between a visitor's browser and our infrastructure travels over TLS 1.2 or 1.3. Legacy protocols (SSLv3, TLS 1.0/1.1) and weak cipher suites are disabled by policy on every domain we manage.
Encryption at rest
Backups, databases and object storage are encrypted at rest using AES-256 (or the equivalent provided by our infrastructure partners). Encryption keys are managed by the underlying cloud provider's key management service, not stored alongside the data they protect.
Automated TLS certificate management
Certificates are issued and renewed automatically ahead of expiry, across the primary domain, www, and any subdomains you connect. You never have to remember a renewal date or install anything manually.
HSTS and secure headers
We ship HTTP Strict Transport Security, a sane Content-Security-Policy, X-Content-Type-Options and Referrer-Policy headers by default, tuned per project so third-party scripts you actually use (analytics, chat, payments) keep working.
DDoS, WAF, backups and restore
DDoS mitigation and WAF
Traffic passes through an edge network with automatic Layer 3/4 DDoS scrubbing and a web application firewall that blocks common attack patterns (SQL injection, cross-site scripting, credential stuffing, known bad bot signatures) before they reach your application.
Rate limiting and bot protection
Login pages, forms and checkout flows are rate limited to slow down brute-force attempts and scripted abuse, with progressively stricter throttling for repeated failures from the same source.
Backups, retention and restore
Full backups run daily and are retained on a rolling 90-day window, stored in a separate region from the primary site so a hosting incident cannot take out your backups too. Our target Recovery Point Objective (RPO) is 24 hours — the maximum data you could ever lose is the gap since the last nightly backup. Our target Recovery Time Objective (RTO) for a full restore is under 4 hours for standard incidents, with critical production outages prioritised ahead of the request queue.
Point-in-time rollback
Because every change ships as a discrete, reviewed request, you can ask us to roll back to any previous daily snapshot within the retention window without waiting on a full disaster-recovery process.
Access control and least privilege
Nobody on our team has more access than their current work requires, and every account with production access is protected the same way.
- Least privilege by default: engineers only get access to the systems and client accounts their current work requires, granted on request rather than by default.
- Two-factor authentication is mandatory on every internal account with access to hosting, DNS, source control or billing systems.
- Access is logged. When a project pauses or closes, or a team member's role changes, access is revoked the same day and reviewed on a recurring schedule.
- Client accounts and repositories are shared with named individuals, never generic shared logins, and passwords are managed through an encrypted password manager rather than sent over email or chat.
Secure development lifecycle
Secure development lifecycle
Every request goes through a build, self-review and QA pass before it reaches you. Code changes are tracked in version control with a clear history, so any change can be traced, reviewed and reverted.
Dependency and vulnerability scanning
Automated tooling scans dependencies for known vulnerabilities on an ongoing basis. Flagged packages are patched and redeployed as part of routine maintenance, not billed as a separate request.
Staging before production
Growth and Scale plans include a staging environment so changes are reviewed in a production-like setting before going live. Launch plan changes are validated in a preview build before deployment.
Principle of least functionality
We remove or disable software and plugins we are not actively using. A smaller footprint means fewer things that can go wrong and fewer things that need patching.
Monitoring, uptime and incident response
We monitor uptime and performance around the clock. Here is what happens, minute by minute, when something goes wrong.
| Time from detection | What happens |
|---|---|
| 0–5 min | Automated uptime and performance monitoring detects an anomaly and pages the on-call engineer. |
| 5–30 min | Initial triage: is this a hosting issue, a third-party dependency, a DNS problem or an application bug? Status is communicated if the impact is customer-facing. |
| 30 min–4 hrs | Fix is applied, tested and deployed, or a rollback to the last known-good state is performed. This work does not consume your monthly request slot. |
| Post-incident | A short written summary is shared on request: what happened, root cause and what changed to reduce the chance of a repeat. |
Data protection and GDPR
Security and data protection go hand in hand. The details of how we collect, process and safeguard personal data live in our legal centre:
Reporting a vulnerability
If you believe you have found a security issue in any Alta Ignite-managed site or system, we want to hear from it before anyone else does. Email security@altaignite.com with a clear description and, where possible, steps to reproduce the issue. We acknowledge every report within one business day, keep you updated as we investigate, and credit responsible disclosure on request. Please do not run automated scanners against production client sites, and give us a reasonable window to fix a confirmed issue before any public disclosure.
Your part in keeping things secure
We handle the infrastructure. A few things on your side make the whole system stronger.
- Use a strong, unique password and enable two-factor authentication on your Alta Ignite account and any CMS logins you hold directly.
- Only grant admin access to people who need it, and let us know promptly when someone leaves your team.
- Tell us about any third-party integrations, embedded scripts or plugins you want installed so we can review them before they touch production.
- Keep any systems you manage independently of us (a separate email provider, a third-party app you connected) patched and monitored on your side.
- Report anything that looks suspicious immediately — a faster report means a faster fix.
Security questions
Where is my site hosted?
On managed edge infrastructure with regional failover. WordPress builds run on hardened managed hosting with a global CDN, and Shopify sites run on Shopify's own PCI-compliant infrastructure.
Who can access my site?
Only the team members you invite plus the assigned Alta Ignite pod. Access is logged, scoped to least privilege and revoked when a project closes.
What happens if something breaks?
Monitoring alerts us first, usually before you notice anything. Critical incidents are triaged immediately and do not consume your request slot.
Can I export everything?
Yes. Ask any time and we hand over the repository, database, media assets and DNS records. There is no lock-in and no exit fee.
Do you hold formal certifications like SOC 2 or ISO 27001?
We do not currently hold a formal SOC 2 or ISO 27001 certification. We run the equivalent operational controls described on this page — encryption, access control, monitoring, incident response and vendor review — and can walk your security team through them directly or complete a vendor questionnaire on request.
Are you GDPR compliant?
Yes. We process personal data under a documented legal basis, sign data processing agreements with clients where required, and rely on subprocessors listed publicly. See our full GDPR overview and privacy notice for the details.
How do I report a security vulnerability?
Email security@altaignite.com with a description and, if possible, steps to reproduce it. We acknowledge reports within one business day and will keep you updated as we investigate and fix confirmed issues. Please avoid automated scanning of production sites and give us a reasonable window to respond before any public disclosure.
What is your uptime like?
Uptime targets and service credits are set out in our Service Level Agreement, along with what counts as a qualifying incident.
Ship on infrastructure you can trust
Every plan ships with the same hardened hosting, encryption, backups and monitoring described above. No security add-on, no extra line item.