Run the audit

Security and compliance

The page to send when someone asks where the app runs, who can reach the data, and what happens if it goes wrong. Every app runs on Prostack Cito, on the same infrastructure as our agency and ecommerce customers.

  • ISO 27001:2022Information security, assessed by the British Assessment Bureau.
  • ISO 9001:2015Quality management.
  • ISO 14001:2015Environmental management.

Where your data lives

  • Two Prostack datacentres in the south of England (Hertfordshire and London), by default. Both are Tier 3, with N+1 redundancy, biometric access and staff on site around the clock.
  • A third in Atlanta, for apps whose users are mostly in the US. Any plan can go there, at the same price.
  • We don’t transfer personal data outside the UK without your written consent, except to countries with UK adequacy regulations or under UK International Data Transfer Agreements.

Data protection

  • Our terms include data processing terms written to meet Article 28 of the UK GDPR. A standalone data processing agreement is available on request.
  • Our sub-processor list is available on request, and you get at least 14 days’ notice of any change to it.
  • We tell you within 48 hours of becoming aware of a security incident affecting personal data.

On every server

  • A firewall that’s closed by default, a web application firewall, and Monarx malware scanning.
  • Operating system updates every night, with reboots scheduled for you.
  • Each site runs as its own system user. SSH can be limited to your IP addresses.
  • Every panel login needs a passkey or two-factor code, with no way to opt out, and there’s an audit log of who did what.

Backups, monitoring and support

  • Nightly encrypted backups, stored off-site and kept for seven days. Longer retention can be arranged, possibly at a charge.
  • 40+ monitors on every server, watched by people 24/7/365.
  • Our in-house team answers tickets in six minutes on average.
  • A 100% uptime SLA on power and network, with service credits if we miss it.

The documents

For a data processing agreement, or our sub-processor list, email [email protected]. For anything else, talk to an engineer.

Now check the app itself

The readiness audit covers the parts IT will ask about inside the app: secrets, who can read the data, and where personal data goes.

Run the readiness auditTalk to an engineer