Trust centre
What we do with your systems, your code and your data
We ask clients to let our engineers read their source and our testers reach their production systems. That is a significant thing to ask for, and the reasonable response is to ask what we do with it. This page answers that without a form, a sales call or an NDA.
Where a control below is scoped, the scope is stated. Where something is not yet in place, it says so. A trust page that claims everything is a trust page nobody believes.
Our own certifications
ISO/IEC 27001:2022 and SOC 2 Type II, both scoped to the delivery of client engagements rather than to a convenient subset.
| ISO/IEC 27001:2022 | CertifiedScope: delivery of cybersecurity and software development services, London and Dhaka. Certificate number and UKAS-accredited body named on /certifications. |
|---|---|
| SOC 2 Type II | Report available under NDASecurity, Availability and Confidentiality criteria. Twelve-month observation window. |
| Cyber Essentials Plus | CertifiedWhole organisation, audited technical controls, annual. |
| ISO 9001:2015 | CertifiedScope: software development delivery. |
| ISO/IEC 27701 | Not heldPrivacy controls are operated under the 27001 ISMS. We have not sought separate 27701 certification and will say so rather than implying it. |
Who touches your systems
Every engineer and tester is background-checked before they are assigned to an engagement, and the policy is published here rather than described on request.
| Identity and right to work | Verified for all staff before start date |
|---|---|
| Basic criminal record check | All staffDBS Basic in the UK; local equivalent elsewhere. Renewed every three years. |
| Enhanced screening | BS 7858 for staff on financial services and public sector engagementsFive-year employment history, two references, credit and sanctions check. |
| Confidentiality | Individual NDA signed at onboarding, surviving termination |
| Subcontractors | Rare, always disclosed before an engagement startsHeld to the same screening standard, named in the statement of work. We do not subcontract testing without telling you who to. |
| Leaver process | Access revoked across identity, devices and client systems on the last working dayCompletion tracked; exceptions escalated to the COO. Stale credentials belonging to former staff is one of the most common findings in our own internal testing, so we audit ours quarterly. |
Your data and your evidence
Engagement evidence lives in a per-engagement encrypted workspace in the region you specify, and is destroyed 90 days after the retest unless you ask us to hold it.
| Isolation | One workspace per engagementNo shared evidence store. A tester on one engagement cannot reach another engagement’s evidence. |
|---|---|
| Access | Named engagement team only, reviewed at engagement close |
| Encryption | AES-256 at rest, TLS 1.3 in transitCustomer-managed keys available on request for retainer clients. |
| Residency | UK or EU by default; other regions on requestStated in the statement of work before work starts, not negotiated afterwards. |
| Retention | Destroyed 90 days after retestExtended only on your written instruction, for example to support an audit. Destruction is logged and the log is available to you. |
| Source code | Read-only access, scoped to the engagement, for the engagement durationCloned only into the engagement workspace. We can work in your environment on your hardware where your policy requires it. |
| Production access | Time-boxed, logged, and revoked at engagement closeWe ask for the least access that makes the engagement possible and will tell you when a scope reduction would cost you coverage. |
Sub-processors
The full list, with what each one processes and where. Material additions are notified 30 days in advance.
| Amazon Web Services | Engagement workspaces, evidence storage — eu-west-2 (London) |
|---|---|
| Microsoft 365 | Email, documents, internal collaboration — UK and EU tenancy |
| Atlassian | Engagement tracking — EU data residency |
| Slack | Client engagement channels — EU data residency, Enterprise Key Management |
| Zoom | Scoping and debrief calls — recordings disabled by default |
| 1Password | Credential management — zero-knowledge architecture |
| DocuSign | Contracts and attestation letters — EU |
We do not use client data to train any model, we do not send client code or evidence to a third-party AI service, and no sub-processor above has access to engagement evidence except AWS as the storage provider.
A current, dated version of this list with each processor’s role, location and transfer mechanism is available as a signed PDF for your DPA annex.
How we test ourselves
We buy an annual external penetration test and a red team from a competitor, and we publish the cadence rather than the results.
| External penetration test | Annual, by an independent CREST-accredited firmNot by us. A firm that only tests itself is not telling you anything. |
|---|---|
| Red team | Every 24 months, independent provider |
| Internal testing | Quarterly, by a team not responsible for the systems tested |
| Secure development | Our own products go through the same secure SDLC we sellThreat model before build, security review on each architectural decision, independent pre-release test. |
| Vulnerability disclosure | Published policy, no NDA required to reportAcknowledged within one business day, triage decision within five. See /legal/vulnerability-disclosure. |
| Patch cadence | Critical within 7 days, high within 30Measured against the date a fix becomes available, not the date we noticed. |
Availability and continuity
We are a services firm, not a platform — the thing that must stay available is our ability to respond, and that is a people problem before it is an infrastructure one.
| Incident response availability | 24/7/365, nine-person analyst rotaRota depth is the real continuity control. A single on-call responder is a single point of failure. |
|---|---|
| Business continuity plan | Tested twice a year, including a full loss-of-office scenario |
| Backup and restore | Restores tested quarterly, not just backups monitoredA backup job reporting success is not evidence of a recoverable backup. We have found that exact failure on client engagements and we test for it on our own systems. |
| Engagement continuity | Every engagement has a named deputySo an illness or a resignation does not stall your work. |
Our incident history
The record
No security incident affecting client data to date. If that changes, this is where it will be recorded, and you will hear from us before you read it here.
The commitment
Notification commitment: we will notify an affected client within 24 hours of confirming an incident that affects their data or systems, with what we know at that point rather than waiting for a complete picture. Regulatory notification obligations under UK GDPR Article 33 and NIS2 are met in parallel, not instead.
A trust page that has only ever said "no incidents" and has no stated commitment about what happens when there is one is not telling you much. The commitment is the part you can hold us to.
Ask us something this page does not answer
- Security questionnaires and customer security reviews
- security@envenox.com — we answer from one source of truth rather than re-deriving each time
- Data protection and DPAs
- privacy@envenox.com
- Report a vulnerability in our own systems
- security@envenox.com, no NDA required