Security

Our Security Commitment

PharmaLink takes the security of your personal data seriously. This page summarises the technical and organisational measures we have in place to protect the platform, your account, and your information. Security is an ongoing process — we continually assess, improve, and document our controls.

Infrastructure Security

WP Engine SOC 2 Type 2 Certification

PharmaLink is hosted on WP Engine, a managed WordPress hosting provider that holds SOC 2 Type 2 certification. This independent audit, conducted by an AICPA-affiliated firm, confirms that WP Engine’s controls for security, availability, and confidentiality operate effectively on an ongoing basis. PharmaLink inherits these infrastructure-level controls.

HTTPS Encryption

All traffic to and from PharmaLink is encrypted using HTTPS (TLS 1.2/1.3). SSL certificates are issued and auto-renewed by WP Engine. Plain HTTP requests are automatically redirected to HTTPS. No data is transmitted over unencrypted connections.

Data Centre Security

WP Engine operates data centres with physical security controls including 24/7 on-site security, biometric access, CCTV monitoring, and environmental controls (fire suppression, redundant power). Detailed information is available in WP Engine’s Security Overview.

Access Controls

Role-Based Permissions

PharmaLink uses a custom two-tier role system. Site Managers (client team) can edit content but cannot access the Elementor page builder or server-level settings. Developers (technical team) have full platform access. This separation limits the blast radius of accidental changes and unauthorised access.

Authentication

All user accounts require a password on registration. Passwords are hashed using WordPress’s bcrypt-based system before storage — plain-text passwords are never stored. We support Google OAuth login via Nextend Social Login for additional convenience and security.

Administrative Access

WordPress admin access requires direct login credentials. WP Engine’s platform enforces SSH key authentication for server-level access — password-based SSH is not permitted. Admin accounts are limited to the minimum number of staff required.

Data Protection

Encryption in Transit

All data transmitted between your browser and PharmaLink is encrypted via HTTPS/TLS. Data transfers between PharmaLink and third-party processors (WP Engine, Stripe, Brevo) also use encrypted connections.

Encryption at Rest

WP Engine encrypts data at rest on its managed storage. Database backups are encrypted and retained for 60 days. WP Engine performs daily automated backups.

Data Minimisation

We collect only the data necessary to provide the platform. Registration fields are limited to those needed to verify eligibility and personalise the CPD experience. Optional fields (LinkedIn, profile photo) are never required.

Secure Development

Version Control and Code Review

All platform code is managed in a private Git repository. Changes are reviewed before deployment. Custom code follows WordPress secure coding standards — all output is escaped, all input is validated, and database queries use prepared statements.

Staging and Testing

All changes are deployed to a staging environment first. Automated end-to-end tests (Playwright) cover critical user flows including registration, login, forum access, and events. Changes are promoted to production only after staging validation.

Dependency Management

Third-party plugins are sourced from the WordPress.org repository or from verified vendors. Plugin updates are applied promptly, particularly for security releases. Inactive plugins are removed rather than left dormant.

Monitoring and Incident Response

Continuous Monitoring

WP Engine provides server-level monitoring, malware scanning, and intrusion detection. Application-level events (failed login attempts, role changes) are logged in the WordPress activity log. Alerts are reviewed by the technical team.

Incident Response Process

In the event of a confirmed security incident affecting user data, PSI/PharmaLink will:

1. Isolate and remediate the affected system
2. Assess the scope and nature of any data exposure
3. Notify affected users within 72 hours of becoming aware, where required by applicable law
4. Notify the relevant supervisory authority (e.g. under GDPR) where legally required
5. Document the incident and implement corrective measures

Third-Party Security

We evaluate the security practices of third-party services before integration. Our key processors (WP Engine, Stripe, Brevo) maintain their own security certifications. Stripe is PCI DSS Level 1 certified — the highest level of payment card security. We do not store card data on PharmaLink servers.

Vulnerability Disclosure

If you discover a security vulnerability on PharmaLink, please report it responsibly by emailing info@pharmalinkhealth.com with the subject line “Security Vulnerability Report”. Include a description of the vulnerability and steps to reproduce it. We ask that you:

• Do not publicly disclose the issue before we have had an opportunity to respond (typically 30 days)
• Do not access, modify, or delete data belonging to other users
• Act in good faith — we will do the same in return

We acknowledge all reports within 5 working days.

Contact

For security-related questions or vulnerability reports, contact us at info@pharmalinkhealth.com.