The information security management system is certified to ISO 27001:2022, demonstrating a systematic, externally verified approach to protecting data across development, operations and delivery.

An annual SOC 2 Type II report covers security, availability and confidentiality for a full operating year, giving customers third-party validation of control design and effectiveness.

Internal controls are reviewed each year to verify conformance with policies and identify improvement opportunities before external assessments occur.

Executive leadership conducts an annual, documented review of security objectives, risks and audit results to ensure the control environment remains aligned with business and regulatory requirements.

Access rights are granted strictly according to job responsibilities and routinely re-evaluated, reducing the attack surface and insider risk.

All supported systems require a second factor or secure logon mechanism, significantly lowering the likelihood of unauthorized account takeover.

Security and system owners review user entitlements every quarter to confirm that privileges remain appropriate and revoke any unnecessary rights.

User accounts are disabled and access revoked as soon as an employee or contractor leaves, preventing lingering access to customer data.

Databases containing customer information are encrypted while stored, ensuring data remains unreadable without authorized keys even if physical media are compromised.

All data exchanges occur over encrypted channels such as TLS or VPN to prevent eavesdropping and tampering on public networks.

Architectural controls separate each customer’s data from others, ensuring that one tenant cannot access or impact another’s information.

Documented classification levels govern how information is stored, processed and shared, aligning protection measures with data sensitivity.

Development follows documented processes that integrate security reviews, automated testing and controlled CI/CD pipelines from code commit to deployment.

All code changes are submitted as pull requests and must be reviewed and approved by another developer before merging, catching defects and malicious code early.

CI/CD pipelines automatically scan software dependencies for known vulnerabilities, preventing vulnerable libraries from reaching production.

Independent specialists perform yearly penetration tests, and findings are tracked through remediation to validate external resilience.

A formal plan defines processes for detecting, triaging, containing and resolving security incidents, ensuring swift, coordinated action.

A dedicated incident response team with clear duties and contact protocols is established to manage events from investigation through resolution.

Post-incident reviews capture lessons and drive control improvements to reduce the likelihood of recurrence.

Defined processes ensure timely notification to customers, authorities and other stakeholders if a breach of personal data or service disruption occurs.

A company-wide continuity plan, reviewed annually, outlines strategies to maintain critical operations and customer support during emergencies.

Customer data is backed up automatically and validated by quarterly restoration tests, confirming data can be recovered within agreed timeframes.

Core infrastructure runs in multiple regions, and cloud providers perform regular failover testing to safeguard against regional outages.

System capacity and resource utilisation are continuously monitored with alerting on predefined thresholds to enable proactive scaling and prevent performance degradation.

Production systems are isolated behind firewalls and segmented networks, limiting lateral movement and exposure to threats.

Direct server access from outside corporate offices requires VPN authentication, adding an extra barrier against unauthorized intrusion.

Firewalls, load balancers and rate-limiting gateways protect service endpoints from malicious traffic and denial-of-service attacks.

Automated tools watch key infrastructure metrics and trigger alerts so engineers can respond quickly to anomalies or failures.

All staff complete security training during onboarding and at least annually thereafter, reinforcing responsibilities for protecting customer data.

Criminal background screening is performed for roles with access to information assets, adding assurance about personnel trustworthiness.

A formal code of conduct sets expectations for ethical behaviour and outlines consequences for policy violations, promoting accountability.

Workspaces must be kept free of sensitive material and screens locked when unattended, reducing the chance of casual data exposure.

New suppliers are vetted by legal and security teams before use, and risk levels dictate ongoing oversight requirements.

Critical vendors must sign DPAs that define privacy obligations and security measures in line with data protection laws.

SOC and other audit reports from cloud and infrastructure providers are obtained and evaluated yearly to confirm continued control effectiveness.

Standard contracts include clear service-level and termination provisions, enabling enforcement or exit if a vendor fails to meet security expectations.

System activities are logged to dedicated repositories isolated from production systems, preserving integrity for investigations and compliance.

Real-time monitoring covers performance, availability and security metrics, enabling rapid detection of issues.

Company devices and the platform use monitoring agents that flag suspicious behaviour for security team review.

Logs are stored in systems that prevent unauthorised modification or deletion, ensuring reliable evidence for audits.

Infrastructure and application changes follow formal workflows covering planning, approval, testing and documentation.

Only authorised personnel can deploy code to production, and each release is recorded for auditability.

Deployment pipelines retain previous versions so services can quickly revert if issues arise, protecting availability.

Changes undergo QA, including checks for malicious code, before they are accepted into the production environment.

Entry to company offices requires authorised access cards or locks, limiting exposure of systems and information.

Devices are tracked, encrypted, wiped before reuse and securely stored or disposed of when retired, protecting data on hardware.

Company laptops and mobile devices use full-disk encryption, preventing data recovery if devices are lost or stolen.

Cloud infrastructure resides in ISO 27001 and SOC-audited data centres with strong physical controls, adding an extra layer of assurance.

Data processed on behalf of customers is automatically removed once contractual retention periods expire, supporting compliance obligations.

Customers can restore deleted candidate data within seven days, providing convenience and mitigating accidental loss.

DLP tools monitor and control external sharing of information, reducing the risk of unintended data leakage.

Backups include both data and application components, ensuring full restoration capability in the event of corruption or loss.

A formal process identifies and prioritises risks each year, with treatment plans approved by the board.

Cross-functional teams review incidents, risks and control changes every month to maintain continuous oversight.

The board of directors receives regular updates and provides guidance on security strategy and performance.

Risk assessments explicitly consider fraud scenarios, and mitigating measures are implemented and reviewed.

The organisation clearly distinguishes processor and controller responsibilities, ensuring lawful processing of personal data.

Standard DPAs embed Article 28 GDPR requirements and set out technical and organisational measures for protecting personal data.

Sensitive information is sent using approved secure protocols, preventing interception over public networks.

Staff follow documented procedures for storing, transmitting and disposing of confidential information, reducing privacy risk.