SimplyDo maintains a strict security posture in its operation and service provision. In this article we highlight some useful areas related to security and compliance.
Compliance Certification
SimplyDo maintains certification against the following security schemes:
-
Cyber Essentials
-
Cyber Essentials Plus
-
ISO 27001
Our service provision is based on infrastructure provided by Amazon Web Services, Microsoft Azure, and Google Cloud Platform.
Data Security
SimplyDo maintains a robust set of controls and policies to safeguard company and customer data.
-
Encryption in-transit: TLS 1.3 (with fallback to TLS 1.2) is used on all public and private networks.
-
Encryption at-rest: AES-256 is used when storing company and customer data (including backups).
-
Strict and robust role-based access control deployed, following principles of least privilege.
-
Multi-factor authentication used by all staff for all services managing customer data.
-
Robust supply-chain and depdendency management and audit processes.
-
Annual multi-day independent penetration tests run against our platform by CREST-approved auditors.
Data Protection
SimplyDo operates in full accordance with relevant data protection principles and legislation, such as GDPR.
-
SimplyDo operates as Data Processor on behalf of its customers.
-
All customer data is fully stored, processed, and backed-up securely within the UK.
-
We have a dedicated Data Protection Officer, who can be reached on dataprotection@simplydo.co.uk.
-
Our Privacy Policy is clearly written and indicated to users, who have a clear mechanism for providing consent to data processing.
Resilience
SimplyDo maintains a robust, regularly tested, and regularly audited Business Continuity Plan, which sets out how we swiftly recover from downtime, incidents, or other unexpected scenarios. It includes information on roles & responsibilities, alternative communication schemes, and regulatory action (where required).