Trust centre
Last updated: [date]
How [Company name] protects the data you trust SHIELD with, in one place for your procurement and security teams.
1. Hosting and data location
All customer data is hosted in the UK/EU with [hosting provider]. Each service and its data location is listed on our sub-processors page.
Our Data Processing Agreement sets out data location contractually. Request a copy from [security email].
2. Access control
Two-factor authentication is mandatory for every account. Each user may hold one active device session, and administrators can sign out any device.
Access is role-based, so people only see the sites and records their role needs.
3. Encryption
Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256.
4. Tenant isolation
Every company is isolated at the database level. Access rules are tested automatically on every release. Cross-company sharing only happens through explicit, revocable grants, and every access is recorded in an audit trail.
5. Resilience
We take point-in-time backups, run restore drills [frequency], monitor uptime continuously and maintain a documented incident response plan.
6. Certifications and testing
[Cyber Essentials / ISO 27001 status]. Independent penetration testing is carried out [frequency] by [testing company]. Summary reports are available under NDA.
7. Reporting a concern
Report a security issue to [security email]. We aim to acknowledge reports within [number] working days.