Security at Westford

1. Encryption in transit

Every page, form, upload and portal session is served exclusively over HTTPS with TLS 1.2 or higher and HTTP Strict Transport Security. Insecure connections are refused.

2. Data handling

Application data and documents are used only for credit assessment, know-your-customer, anti-money-laundering and sanctions screening, and servicing of an agreed facility. Access is restricted to your deal team, credit and compliance staff on a need-to-know basis.

We do not sell personal information and we never ask you to send passwords, full card numbers or one-time codes by email or phone.

3. Account protection

The client portal uses single-use, time-limited secure links, optional two-step verification with an authenticator app, and automatic sign-out after 15 minutes of inactivity. The last sign-in time is shown so you can spot unexpected access.

4. Payments and wire instructions

Funds are only ever disbursed to, or collected from, accounts named in a signed facility agreement. We will never change our bank details by email. If you receive new payment instructions, call your deal officer on a number you obtained independently before acting.

5. Assurance programme

Our controls are aligned with the NIST Cybersecurity Framework and ISO/IEC 27001 practices, including vendor due diligence, access reviews, logging and incident response. We do not claim a certification we have not been awarded; the current status of any external audit is available to clients on request.

6. Responsible disclosure

If you believe you have found a security vulnerability, please report it via our disclosure page or to security@westfordfinance.com. We acknowledge reports within two business days.