Snapshot 192925
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Certifications Four certificates, each downloadable in full. Information security management ISO/IEC 27001:2022 The standard for how an organisation manages information security: risk assessment, access control, incident response and continual review, audited by a third party. Download certificate → Privacy information management ISO/IEC 27701:2019 The privacy extension of ISO 27001. It covers how personal data is handled as a controller and as a processor, which is the distinction a GDPR assessment turns on. Download certificate → Women's Business Enterprise National Council WBENC Certifies the company as a women-owned business. Relevant where supplier diversity is part of procurement policy. Download certificate → U.S. Small Business Administration WOSB Woman-Owned Small Business certification, used in United States federal contracting. Download certificate → What the contract commits us to Numbers taken from the agreements themselves, with the clause named so you can check them. 99,9 %Monthly availabilityTerms of Use, clause 8.1 72 hBreach notificationData Processing Agreement, clause 11.3 60Days to retrieve your dataTerms of Use, clause 13 6Named sub-processorsData Processing Agreement, Annex 1 How the platform is run The controls behind the ISO certifications, as set out in the privacy policy. Access follows least privilege, enforced rather than assumed. Personal data is encrypted in transit and at rest. Everyone on staff trains on security and privacy obligations, on a schedule. Risks to personal data are assessed and managed continuously. There is a formal incident response plan, not an improvised one. Third-party providers go through due diligence and ongoing monitoring. Systems run in AWS secure data centres. Security and privacy are part of product design, not added afterwards. Privacy Policy, section 11 How the platform enforces roles, hierarchies and audit trails: Governance & Security → Who else touches the data The complete list from Annex 1 of the Data Processing Agreement, with country and purpose. A sub-processor nobody names is a sub-processor nobody reviewed. Company Country Purpose Amazon Web Services, Inc. United States Platform hosting Coralogix Ltd. Israel / Singapore Log files ZOHO CORPORATION B.V Netherlands Support ticketing Google LLC United States Staff email Hyverr S.R.O Czech Republic Second-level support PurpleTalk Inc India Third-level support The documents themselves Data Processing Agreement (Art. 28 GDPR) Privacy Policy Terms of Use Cookie Policy