Trust starts with clarity.
Who we are, how this website works, and what to ask before adopting GovBridge. Company registration, product security and independent certification are different things.
Company information
Check the Companies House record ↗. You can also search reference ZC197019 in the ICO public register ↗. Registration is not a security accreditation or an endorsement of our products.
This company website
This marketing website is separate from GovBridge’s application infrastructure. Website delivery is not described as UK-only hosting.
The website uses an encrypted connection. HTTPS alone does not certify an organisation’s security.
Google Analytics loads only after acceptance. Use Cookie settings in the footer to change your choice.
This site does not require an account or collect payment details. Please do not email credentials or sensitive client records.
Read our Privacy Policy and Cookie Policy for website data handling.
GovBridge: developer preview
GovBridge is a product of Yug Solutions Ltd. It is independent: not a government service, and not endorsed by any government department. It is in developer preview: anyone can sign up and try it free, HMRC connections are test-only, and what’s available may change before general availability. You can check live availability on the GovBridge status page ↗.
How GovBridge protects data today
What is in place as of October 2026, in plain English. These are our own measures, not an independent certification.
The GovBridge API runs on OVHcloud in London. Its database (Supabase) and cache (Upstash) are in their London regions. Encrypted off-site backups are kept in the EU.
HMRC sign-in tokens are encrypted before they are stored and are never written to logs. HMRC is test-only during the preview.
National Insurance numbers, tax references (UTR) and VAT numbers are masked in application and web-server logs.
Keys are stored only as a hash, can be revoked from your dashboard at any time, and usage is rate-limited per key.
Encrypted database backups run every four hours, with an alert if one is missed. Restores were rehearsed on 4 and 9 October 2026.
Administration requires an approved Google account with 2-Step Verification. The service runs in a locked-down container without administrator rights.
Code, dependencies and container images are scanned automatically for known vulnerabilities and leaked secrets.
A signed data protection impact assessment and an independent penetration test, both required before any live HMRC filing.
Before using GovBridge with real business data, ask us for the product details you need: subprocessors, retention, access controls and incident handling. Website policies are not a substitute for product terms or a data processing agreement.
Development milestones are recorded in our company ledger. These are development updates, not independent security assurance.
Certification and procurement
We do not claim that Yug Solutions holds ISO 27001, SOC 2 or Cyber Essentials certification. A hosting provider’s certifications do not certify our company or product.
For a procurement review, contact us with the evidence you need: a data flow diagram, processing agreement, access-control overview, backup and recovery arrangements, or security testing scope. We will discuss what is available and any outstanding work.
Report a security concern
Email hello@yugsolutions.co.uk with the subject “Security report”. Include the affected URL, a description and safe reproduction steps. Avoid including personal data, passwords or API keys. Contact us first if you need a secure way to share sensitive evidence.
Questions before working with us?
Tell us about your requirements and the systems involved. We can discuss scope, responsibilities and the evidence you need to make a decision.
Start a due diligence conversation ↗