Trust Center.
How we protect your documents, your data and your customers' data. Last updated September 2026.
Programme status and control descriptions are maintained with our security team and updated as certifications mature. Hosting and data-residency wording awaits ops confirmation before production.
- SOC 2 Type IIIn progress
- UK GDPR and EU GDPRIn progress
- Cyber Essentials PlusPlanned
- ISO 27001Planned
Security at every layer.
The controls your security team will ask about, in one place.
Hosting and data residency
Hosted on AWS in the UK, Australia and New Zealand. Customer data stays in the region you choose.
Encryption
Data encrypted in transit with TLS 1.2+ and at rest with AES-256. Keys managed in AWS KMS.
Access control
Two-factor authentication, role-based permissions and least-privilege access for our staff. Every access is logged.
Customer isolation
Each customer's documents and findings are logically separated. Nothing is shared without your say-so.
Monitoring and logging
Continuous monitoring, alerting and tamper-evident audit logs, retained for 24 months.
Backup and recovery
Encrypted daily backups, tested restores, and a recovery objective of 24 hours.
Secure development
Code review on every change, automated dependency and vulnerability scanning, separate environments.
Independent testing
Annual penetration test by an accredited third party. Summary available under NDA.
Your data, your control.
- Your data is yours
- You own every document and finding. We process it only to provide the service.
- AI and your data
- Your documents are never used to train AI models. Model providers are contracted not to retain them.
- Retention and deletion
- Data kept for the life of your contract, then deleted within 30 days on request, with confirmation.
- People
- Staff are background-checked, sign confidentiality terms and complete security training every year.
Subprocessors.
The providers that help us run PolicyCheck. We'll tell you before adding a new one.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage and compute | United Kingdom, Australia and New Zealand |
| AWS Bedrock | Reading documents | United Kingdom, Australia and New Zealand |
| Google Workspace | Email and support | United States (global SaaS) |
| Slack | Finding notifications (optional) | United States (global SaaS) |
Documents on request.
Everything a procurement or security review needs.
SOC 2 report
Available under NDA once the programme is complete.
Penetration test summary
Latest independent test, under NDA.
- View
Data Processing Agreement
Our standard DPA, ready to sign.
Security questionnaire
Completed standard questionnaire, to save you time.
Found a vulnerability?
Tell us at security@policycheck.co.nz. We respond within two working days and credit responsible disclosure.