Trust.
How we protect customer content: storage and keys of its own for each customer, row-level isolation in the database, a second factor at sign-in, an append-only audit trail, and hosting in Google Cloud's London region. The policies behind it are below.
Policies
- Information security policyVersion 1.0 · 27 October 2026PDF
- Acceptable use policyVersion 1.0 · 27 October 2026PDF
- Access control policyVersion 1.0 · 27 October 2026PDF
- Data classification and handlingVersion 1.0 · 27 October 2026PDF
- Data retention and disposal policyVersion 1.0 · 27 October 2026PDF
- Incident response policyVersion 1.0 · 27 October 2026PDF
- Business continuity and disaster recoveryVersion 1.0 · 27 October 2026PDF
- Change management policyVersion 1.0 · 27 October 2026PDF
- Secure development policyVersion 1.0 · 27 October 2026PDF
- Logging and monitoring policyVersion 1.0 · 27 October 2026PDF
- Vendor management policyVersion 1.0 · 27 October 2026PDF
- AI use policyVersion 1.0 · 27 October 2026PDF
- Workstation security policyVersion 1.0 · 27 October 2026PDF
- Security scheduleVersion 1.0 · 27 October 2026PDF
How we handle personal data is in the privacy notice.
Restricted pack, on request under NDA
- Architecture diagram (sanitised)
- Internal security assessment and remediation status
- Vulnerability scan summary
- Restore rehearsal record
- Certificate of insurance
- Access review
- Data processing agreement template
- Penetration test summary