- Standard
- In progress
Informed by ISO/IEC 27001
Self-assessed by IdeaScore. Not certified by an outside body.
The international standard for an information security management system.
In place
- The security measures listed under Security Practices on this page.
- Secrets live in the hosting environment, never in the database or the source code.
- Each release passes automated tests, including tests of these safeguards.
Work in progress
- The management system: its scope, a risk register and a risk treatment plan.
- A Statement of Applicability covering all 93 Annex A controls, each with a reason and a status.
- The policy set: information security, access control, incident response, continuity, retention, vendors, acceptable use, change, cryptography and secure development.
- A yearly internal review by someone who did not write the control, and a management review.
- A signed supplier's declaration of conformity under ISO/IEC 17050-1.
Evidence
- Security pagePublished
- Statement of ApplicabilityOn request
- Risk register summaryOn request
Limits
- No accredited certification body has assessed us.
- IdeaScore is a small team, so a fully independent internal review is not yet possible. The declaration will record this.
Bring Your Questions to a Product Specialist
A 30-minute walkthrough of the Trust Centre, the Data and Privacy card and the Decision Trail, with your committee's questions.