Security
Security at Clear Decisions
ISO/IEC 27001:2022 certified by the British Assessment Bureau. Customer data is hosted on Google Cloud in the EU. The documentation behind this page is available on request.
Kaion this page
“Security questionnaires are where deals stall. Everything on this page is written so you can forward it to whoever is asking. Where we hold a certificate I say so and name the issuer; where we are working towards one I say that instead.”
Certification
- ISO/IEC 27001:2022
- Certified by the British Assessment Bureau, certificate 271875. The certificate is available on request.
Hosting
- Built on Google Cloud
- Customer data is hosted in Google Cloud data centres in the EU.
Encryption
- In transit
- TLS 1.2 and 1.3, with HTTP Strict Transport Security (HSTS).
- At rest
- Platform data is stored encrypted with AES-256.
Access control
- Multi-factor authentication
- Sign-in uses time-based one-time passwords (TOTP) and email verification: users enter a six-digit code to complete the login.
- Infrastructure access
- Access to production systems is controlled through Google Cloud Identity and Access Management (IAM).
Data protection
- UK GDPR and EU GDPR
- We process personal data under UK GDPR for UK customers and EU GDPR for EU customers.
- ICO registration
- Registered with the UK Information Commissioner’s Office, registration number ZB751788.
- Data Processing Addendum
- Our Data Processing Addendum, and the list of sub-processors, are available on request.
People
- Policies
- A set of risk-based security policies, shared with and trained on by all employees and contractors.
- Training
- Security training is mandatory for anyone with access to Clear Decisions systems, at initial access and annually thereafter.
- Confidentiality agreements
- Employees and third parties with logical access to systems and information sign non-disclosure agreements.
Security questions
For the certificate, the Data Processing Addendum, the sub-processor list or a questionnaire, get in touch.
