Skip to content
Help Center

Article1 min read

Security & compliance

Certifications, data security, data protection and resilience.

SimplyDo maintains a strict security posture in its operation and service provision. In this article we highlight some useful areas related to security and compliance.

Compliance Certification

Section titled “Compliance Certification”

SimplyDo maintains certification against the following security schemes:

  • Cyber Essentials
  • Cyber Essentials Plus
  • ISO 27001

Our service provision is based on infrastructure provided by Amazon Web Services, Microsoft Azure, and Google Cloud Platform.

Data Security

Section titled “Data Security”

SimplyDo maintains a robust set of controls and policies to safeguard company and customer data.

  • Encryption in-transit: TLS 1.3 (with fallback to TLS 1.2) is used on all public and private networks.
  • Encryption at-rest: AES-256 is used when storing company and customer data (including backups).
  • Strict and robust role-based access control deployed, following principles of least privilege.
  • Multi-factor authentication used by all staff for all services managing customer data.
  • Robust supply-chain and dependency management and audit processes.
  • Annual multi-day independent penetration tests run against our platform by CREST-approved auditors.

Data Protection

Section titled “Data Protection”

SimplyDo operates in full accordance with relevant data protection principles and legislation, such as GDPR.

  • SimplyDo operates as Data Processor on behalf of its customers.
  • All customer data is fully stored, processed, and backed-up securely within the UK.
  • We have a dedicated Data Protection Officer, who can be reached on dataprotection@simplydo.co.uk.
  • Our Privacy Policy is clearly written and indicated to users, who have a clear mechanism for providing consent to data processing.

Resilience

Section titled “Resilience”

SimplyDo maintains a robust, regularly tested, and regularly audited Business Continuity Plan, which sets out how we swiftly recover from downtime, incidents, or other unexpected scenarios. It includes information on roles & responsibilities, alternative communication schemes, and regulatory action (where required).