What we can prove
Every claim on this page points at something you can open: a certificate, a clause, a named company. Nothing here is a badge without a document behind it.
Certifications
Four certificates, each downloadable in full.
Information security management
ISO/IEC 27001:2022
The standard for how an organisation manages information security: risk assessment, access control, incident response and continual review, audited by a third party.
Download certificate →Privacy information management
ISO/IEC 27701:2019
The privacy extension of ISO 27001. It covers how personal data is handled as a controller and as a processor, which is the distinction a GDPR assessment turns on.
Download certificate →Women's Business Enterprise National Council
WBENC
Certifies the company as a women-owned business. Relevant where supplier diversity is part of procurement policy.
Download certificate →U.S. Small Business Administration
WOSB
Woman-Owned Small Business certification, used in United States federal contracting.
Download certificate →What the contract commits us to
Numbers taken from the agreements themselves, with the clause named so you can check them.
How the platform is run
The controls behind the ISO certifications, as set out in the privacy policy.
- Access follows least privilege, enforced rather than assumed.
- Personal data is encrypted in transit and at rest.
- Everyone on staff trains on security and privacy obligations, on a schedule.
- Risks to personal data are assessed and managed continuously.
- There is a formal incident response plan, not an improvised one.
- Third-party providers go through due diligence and ongoing monitoring.
- Systems run in AWS secure data centres.
- Security and privacy are part of product design, not added afterwards.
Who else touches the data
The complete list from Annex 1 of the Data Processing Agreement, with country and purpose. A sub-processor nobody names is a sub-processor nobody reviewed.
| Company | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | United States | Platform hosting |
| Coralogix Ltd. | Israel / Singapore | Log files |
| ZOHO CORPORATION B.V | Netherlands | Support ticketing |
| Google LLC | United States | Staff email |
| Hyverr S.R.O | Czech Republic | Second-level support |
| PurpleTalk Inc | India | Third-level support |