Web hosting
Managed hosting can be provisioned in the European Union or the United States. You choose the region at order; we confirm it in writing before provisioning and do not move a service between regions without your agreement.
Trust & Security
How we work inside your systems.
Our work touches your hosting, DNS, domains, email and website — the parts of a business that cannot afford to be handled loosely. This page sets out, without ambiguity, who you are contracting with, where your services run, how we handle access and credentials, and what we commit to if something goes wrong.
Who you are dealing with
One company. No chain to untangle.
TK WebHosts Ltd provides the service, issues the invoice, is responsible for your data and is liable under the contract.
The company
| Legal entity | TK WebHosts Ltd |
| Registered in | England & Wales |
| Company number | 10252550 |
| Registered office | 20-22 Wenlock Road, London, N1 7GU, United Kingdom |
| Service provider | TK WebHosts Ltd |
| Contracting party | TK WebHosts Ltd, under our Terms of Service |
| Who invoices you | TK WebHosts Ltd. Invoices, services and payment methods are managed in your client billing area. |
| Responsible for your data | TK WebHosts Ltd is the data controller for your account and business information, and acts on your instructions when handling data inside your own systems. See our Privacy Policy. |
| Liable under the contract | TK WebHosts Ltd, on the terms and within the limits set out in our Terms of Service. |
How to reach us
| UK | +44 20 3877 7555 |
| US | +1 551 525 5551 |
| Written inquiries | Contact page |
| Existing clients | Support tickets and account changes through your client billing area, so every request is logged against your account. |
| Security concerns | If you believe an account or service we manage for you has been compromised, contact us by phone first and follow up in writing. |
Confidentiality, data protection, our security obligations, breach notification, our responsibility for mistakes, response commitments and the limits of liability are written into our Terms of Service, not only this page.
Where your services run
Hosted in the region you choose.
Data location matters for privacy obligations, latency and, for many of our clients, for who they are allowed to work with. We tell you where a service will run before it is provisioned.
Business email
Mailboxes on your own domain can be provisioned on infrastructure located in the European Union or the United States, and platform mailboxes are provisioned in the platform's own region on your instruction. Where residency is a requirement, say so at order and we will confirm the location in writing.
Domains and DNS
Domains are registered in your name, with you as the registrant, so ownership is never in question. DNS is served from globally distributed infrastructure so records resolve quickly wherever your visitors are.
Our access model
Temporary, least-privilege access — and a written way to end it.
We use temporary, least-privilege access wherever the platform allows it, we require multi-factor authentication on every account we touch, and we always recommend changing credentials once the work is complete.
01 — A named account, not your login
Delegated access where the platform supports it
You create a user, delegate or collaborator access specifically for us — a DNS editor, a partner delegation on your email platform, an administrator role on your site. We do not work from your primary owner login and we do not share accounts between clients. Where a platform offers no delegated access, we will need to sign in with your credentials to carry out the work; in that case you provide temporary login details for the duration of the engagement, and we ask you to change the password as soon as the work is complete.
02 — Least privilege by default
Only the roles the work requires
We ask for the narrowest role that lets us do the job and tell you before requesting anything broader. Where we manage a service for you on our own infrastructure — hosting, DNS, mailboxes — access is scoped to your account alone.
03 — Multi-factor authentication
Required on anything we are granted
If MFA is not yet enabled on an account you give us access to, enabling it is the first thing we ask of you, and we will walk you through it. Our own internal accounts are protected the same way.
04 — Time-boxed to the work
Access ends when the engagement ends
Project access is granted for the work in hand. Standing access exists only under a maintenance or managed-service arrangement you have agreed to in writing, and is reviewed if that arrangement ends.
05 — Documented revocation
A written checklist at close
Every engagement finishes with a revocation checklist so you can remove our access with certainty. It is published in full below, and you may ask for it at any point during the work.
06 — Credentials
Held in one place, never retained
Credentials are stored only in an encrypted password manager — never in chat threads, email, documents or screenshots. Anything sent to us over an insecure channel, we ask you to rotate. We do not keep your credentials once the engagement ends.
Operational controls
The controls we apply, stated as we operate them.
Backups
Managed hosting and website maintenance plans include automated daily backups, retained for 30 days on storage separate from the server that runs your site, with restores carried out on request. Business email is protected by the platform's own redundancy and by our export-before-change practice.
Prior state captured before every change
Before any DNS, email, hosting or website change we capture the existing state — a zone export, a configuration snapshot or a full site backup — so the change can be reverted precisely. Website updates are tested on a staging copy first and pushed to live during low-traffic windows.
Backup and restore responsibilities
We restore what we changed, and we restore from our backups on the plans that include them. Your own backup regime continues to cover anything outside the scope of our work, and we will tell you plainly if we think it needs attention.
Monitoring
Sites on maintenance plans are checked around the clock for availability, and we monitor for security and, where email is in scope, for authentication and reputation drift — so a problem is caught early rather than reported to us by your customers.
Incident notification
If we cause or discover a security incident affecting your services or data, we notify you within 24 hours of becoming aware of it, tell you what we know and what we have done, and cooperate with you in responding, including any notifications you are required to make.
Data retention and deletion
Working data from an engagement — exports, screenshots, reports and diagnostic output — is retained for no more than 90 days after close and then deleted, unless you ask us in writing to keep it. Account and billing records are kept for as long as UK law requires.
Payments
Card payments are handled by PCI DSS-compliant payment processors. Full card numbers are not stored on our systems. Invoices, payment methods and renewals are visible and manageable in your client billing area at any time.
Our own systems
Every internal account is protected by multi-factor authentication, the devices we work from are disk-encrypted, and client work is separated per account. What we learn about your business, systems and customers stays confidential during the engagement and after it.
Service commitments
What we commit to — and what we deliberately do not claim.
We publish response commitments we can keep on every working day. We do not publish blanket uptime or inbox-placement guarantees, because no honest provider controls every link in that chain; where a specific plan carries a service level, it is written into that plan's quote.
| Area | Commitment | Notes |
|---|---|---|
| Response | We acknowledge every message about an active service or engagement within one business day. | UK and US business hours, Monday to Friday. Most replies are same-day. |
| Outages | An email or website outage on a service we manage takes priority over scheduled work. | Report by phone for fastest handling, then in writing so it is logged. |
| Written quotes | A written scope, price and timeline within 24 hours of a consultation, before any custom work begins. | Material scope changes are re-confirmed in writing. |
| Change windows | Planned changes to services we manage are scheduled outside your busiest hours and notified in advance where they carry any risk of interruption. | Emergency security patches may be applied sooner; you are told afterwards. |
| Uptime | Continuous availability monitoring on maintenance and managed plans; no blanket numeric uptime guarantee. | Plan-specific service levels, where quoted, are stated in that plan's terms. |
| Deliverability | Authentication, configuration and reputation issues diagnosed and fixed properly, with a written explanation of what changed. | No provider can guarantee inbox placement; we do not claim to. |
Revoking our access
The checklist we send at the close of every engagement.
Work through it, reply to confirm, and we confirm in return that we hold no credentials and that working data will be deleted within 90 days.
1
Remove our user or delegation
On each platform involved — registrar, DNS provider, hosting control panel, email administration, CMS — remove the user, delegate or collaborator access created for us.
2
Revoke keys and tokens
Revoke any API key, access token, application password or OAuth grant issued to us during the work.
3
Rotate shared credentials
Change any password that was shared with us directly rather than created for us, and anything sent over an insecure channel.
4
Confirm MFA and recovery methods
Check MFA remains enabled on every account we touched, and that no recovery method has been added that you do not recognize.
5
Review the change log
Every engagement is delivered with a record of what was altered, so you can verify it independently.
6
Confirm back to us
Reply to confirm revocation is complete. Where a managed service continues, only the access that service requires remains, and it is listed for you.
Data protection
UK GDPR, on the record.
TK WebHosts Ltd processes personal data under UK data protection law. We act as controller for your account and business information, and as processor — on your documented instructions — for data inside the systems we manage or access for you. A data processing agreement is available on request for business clients that need one; ask through your client billing area or the contact page.
Our Privacy Policy sets out what we collect, why, how long we keep it, and your rights.
Sub-processors
Providers we rely on, by category.
- Data-center and cloud infrastructure providers in the European Union and the United States
- Domain registries, registrars and DNS infrastructure
- Email infrastructure and deliverability tooling
- Payment processors and the client billing platform
- Ticketing, scheduling, analytics and password-management tools
Each is bound by contractual confidentiality and security obligations and acts on our instructions. Because our client base spans many jurisdictions and providers change over time, we publish categories here and disclose specific providers to clients on request.
Before you grant access
Questions your security or procurement team needs answered?
Read the Terms of Service for the contractual version of everything on this page, or talk to us before any access is granted. We would rather answer the hard questions first.
Read the Terms of Service Contact us