Trust centre
How we protect your data
When you give us access to your systems, you are trusting us with your business. This page sets out the security practices we follow, the standards we work to and how to contact us about a security concern.
- ISO 27001-aligned practices
- UK GDPR
- MFA on staff accounts
- Encrypted backups
- Least-privilege access
Our practices
The controls we apply to ourselves
The same controls we recommend to clients, applied to the accounts, tools and devices we use to support you.
Access control and least privilege
Every engineer has a named account. Access to client systems is limited to what each person needs for their role, admin rights are used only for admin work, and access is removed promptly when someone leaves.
Multi-factor authentication
Multi-factor authentication is required on our staff accounts and on the tools we use to reach client systems, including our remote monitoring and management platform.
Encrypted backups
Backups we manage are encrypted, kept separate from the systems they protect and test-restored regularly, so recovery is a known process.
Patching and endpoint protection
Our own devices and servers are kept up to date, protected by managed endpoint security and encrypted, in line with the Cyber Essentials controls.
Logging and monitoring
Sign-ins and administrative actions on our systems are logged, and security alerts are reviewed by an engineer rather than left in an inbox.
Supplier management
We check the security of the providers we rely on before we use them, keep a register of who processes client data, and review it when suppliers change.
Standards
Aligned to recognised standards, described accurately
We run our business to the framework of ISO 27001, the international standard for information security management: we assess risks, keep policies current and review how we work. We are ISO 27001-aligned, not certified, because certification requires an external audit we have not yet undertaken.
Where we process personal data on your behalf while supporting your systems, we act as a data processor under UK GDPR and put data processing terms in place in our agreements.
- ISO 27001-aligned information security practices
- UK GDPR: data processing terms in our client agreements
- We prepare clients for Cyber Essentials and ISO 27001 certification
Incident response
If something goes wrong
We plan for incidents before they happen. If one affects your systems or data, this is how we handle it.
Step 1: Detect
Alerts from our monitoring, a report from you or a supplier notice start the process, logged with a time.
Step 2: Contain
We isolate affected accounts, devices or services and preserve the evidence needed to investigate.
Step 3: Tell you
We tell affected clients without undue delay, with the facts you need to meet your own reporting obligations.
Step 4: Recover
We restore services and data from known-good backups and confirm everything is working.
Step 5: Review
We record what happened and what we are changing, and share the findings with you.
Details
Sub-processors, disclosure and due diligence
Sub-processors
We use a small number of third-party providers, such as cloud hosting, email and productivity services, to deliver our services. A current list of the sub-processors that may handle client personal data is available on request from support@denwen.co.uk.
Responsible disclosure
If you believe you have found a security vulnerability in our website, platforms or services, please email support@denwen.co.uk with “Security” in the subject line. Include enough detail for us to reproduce the issue.
- Do not access, change or delete data beyond what is needed to show the issue.
- Do not disrupt our services or those of our clients, and do not use social engineering.
- Give us reasonable time to fix the issue before telling anyone else.
We will acknowledge your report, keep you updated and let you know when the issue is fixed.
Security questionnaires
If you need to assess us as a supplier, we are happy to complete your security questionnaire or due-diligence pack. Ask your account contact or email support@denwen.co.uk.
Service status and incidents
Clients with a live issue should call the service desk or email support@denwen.co.uk. If an incident affects several clients, we contact affected clients directly with updates.
Security contact
Security concern or live incident?
Clients with a live issue: call the service desk now. To report a vulnerability or request our sub-processor list, email the support team.