Access is role-based and logged, and every organisation's data is separated. The same record that supports assurance also answers a security review.
How your data is handled
Encrypted in transit and at rest
All traffic to the platform uses TLS. Stored data and uploaded evidence documents are encrypted at rest.
Separated per organisation
Each organisation's data is logically separated. A firm-tier account holds each client in its own workspace, and access is granted per engagement.
Role-based access
A site user enters their site's data. A reviewer approves. An auditor reads. Nobody gets more than their role requires, and changes to roles are recorded.
Access is logged
Who viewed, entered, changed or exported what, and when. The same log that supports assurance also supports a security review.
Deletion and export on request
You can export your full dataset, including evidence documents, at any time. On termination your data is exported and then deleted on the schedule set out in the agreement.
Vendor and processing transparency
The sub-processors used to run the service, and what each one handles, are set out in the data processing agreement rather than left implicit.
What we will not claim
We will not list certifications we do not hold. If your procurement process requires a specific certification, a completed security questionnaire, or a data residency commitment, ask us directly and you will get a straight answer about what is in place today and what is on the roadmap.
Ask a security question