This statement is a short summary of our approach to data privacy, intended for customers and prospective customers carrying out their own due diligence. For the complete, legally detailed version, see our full Privacy Policy.
1. Who we are
CyberSec Compliance Ltd (company number 17285687) is a UK company providing a compliance documentation and readiness platform for the NCSC Cyber Assessment Framework (CAF), ISO/IEC 27001, Cyber Essentials / Cyber Essentials Plus, and Cyber Insurance readiness evidence. We act as the data controller for the personal data our customers give us.
2. Our core commitments
- UK data sovereignty. Our platform is self-hosted on infrastructure located in the United Kingdom. Customer data is not transferred outside the UK as part of normal service operation.
- Minimal third-party sharing. We only share data with the small number of sub-processors genuinely needed to run the service (see our Sub-Processors page) - we do not sell data, and we do not run your business or security data through any third-party AI service.
- Purpose-limited collection. We only collect what's needed to deliver the service you've purchased: company profile information, your questionnaire answers, account details, and correspondence.
- Your rights are real, not just written down. You can request access, correction, deletion, or a portable export of your data at any time, and we'll act on it - see section 8 of our full Privacy Policy for the complete list of UK GDPR rights.
- Security by design. Access to customer data is restricted to what's operationally needed, and every customer-facing part of our platform is scoped so one customer's data is never visible to another.
3. Security and resilience
- Encryption at rest. Every generated document and report is individually encrypted (AES-256-GCM) on our servers, decrypted only in memory when you download it.
- Encryption in transit. All traffic to our website and portal is encrypted (TLS).
- Backups. We take automated daily full-platform backups, encrypted before they ever leave our server and stored with a UK-based provider (Civo).
- Breach notification. If a personal data breach affecting your data occurs, we will notify you without undue delay and, in any event, within 72 hours of becoming aware of it - the same statutory deadline that applies to our own notification to the ICO.
4. Retention
We keep your data for as long as your account is active, plus a 30-day grace period after cancellation so you can download anything you need, after which it's deleted or anonymised (save for anything we're legally required to retain, such as payment records).
5. Questions or concerns
Contact us at info@cyberseccompliance.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
