Security & Infrastructure Statement

Our technical and organisational security measures. Primary hosting on AWS London (eu-west-2). Encryption in transit and at rest. Role-based access controls and MFA. Regular penetration testing. ISO 27001 principles. Cyber Essentials certified. Staff trained in data security. Breach notification to Data Controllers within 72 hours. Sub-processors include AWS, Microsoft Azure, OpenAI (API only — no model training), Google Gemini, Wonde (MIS integration), Cloudflare, Stripe (PCI-DSS compliant). SLA includes right to termination for repeated or prolonged downtime.

📋 Full statement document coming soon