Cyber Essentials certified. Security policies meeting ISO 27001 standards. UK data centres only. Your data stays where it should, under your control and protected by real security measures.
Certifications
We don't just say we're secure. We prove it with recognised certifications.
Government-backed certification for cyber security. Passed, not pending. We meet the baseline for protecting against common cyber attacks.
Security policies and procedures meeting ISO 27001 standards. The international standard for information security management.
Built for UK and EU data protection requirements. Data processing agreements, subject access requests, and right to deletion built in.
Data Protection
Your data stays in the UK. Not routed through servers abroad. Not stored in jurisdictions with different data laws. UK data centres only.
All data encrypted when stored. AES-256 encryption. Even if someone accessed the physical storage, your data would be unreadable.
TLS 1.2+ for all connections. Your data is encrypted between your browser and our servers. No exceptions.
Control who sees what. Granular permissions by role, team, or individual. Users only access what they need.
154+ event types logged. Every login, every change, every access. Full trail of who did what and when. Exportable for compliance.
API keys with granular permissions. Rate limiting. IP allowlisting available. Secure integration without exposing your system.
Access Control
Granular permissions. Multi-factor authentication. IP restrictions. You decide who gets in.
Optional 2FA for all users. TOTP-based. Add an extra layer of security to every login.
Restrict access by IP address or range. Lock down access to your office network if required.
Automatic session timeout. Force logout across devices. See active sessions and revoke access.
Each customer's data is logically isolated. No cross-tenant data access. Your data is yours alone.
Audit Trail
Every action logged. Every change recorded. When auditors ask what happened, you have the answer. Exportable reports for compliance reviews.
What we promise you.
Your data is yours. We don't sell it, share it, or use it for anything except running your system.
If something goes wrong, you'll know. We disclose security incidents promptly and clearly.
Ongoing security assessments. We don't set and forget. We continuously improve.
Security questions answered by real people in the UK. Not outsourced, not scripted.
Data Processing
Full transparency on data processing, sub-processors, and data flows. Everything your DPO needs to complete a vendor assessment.
We provide a comprehensive DPA covering GDPR Article 28 requirements. Includes data processing purposes, categories of data subjects, security measures, and sub-processor obligations.
Available on request before contract signingWe use a limited number of sub-processors, all UK or EU-based. Our primary infrastructure runs on UK data centres. We notify customers before adding any new sub-processor.
Current sub-processor list available on requestConfigurable data retention policies per workflow. Automated deletion schedules. Complete data export in standard formats. Full deletion on contract termination with certificate of destruction.
Retention periods configurable per case typeExport your data at any time in CSV, JSON, or XML formats. No vendor lock-in. Your data is yours and you can take it with you.
Self-service export available in all tiersCompliance Journey
Achieved SOC 2 Type I attestation covering security, availability, and confidentiality trust service criteria.
Upgraded to Cyber Essentials Plus with independent vulnerability assessment and penetration testing.
Security policies and procedures aligned to ISO 27001 standards with internal audit programme.
Achieved Cyber Essentials certification, the UK government-backed scheme for cyber security.
Full GDPR compliance programme including DPA templates, DSAR handling, and data protection impact assessments.
Need to complete a vendor security assessment? We can provide pre-completed responses to standard security questionnaires including CAIQ, SIG, and bespoke formats.
We're happy to discuss our security measures, provide documentation for your compliance team, or answer specific questions about how we protect your data.
