Security you can verify.
Trust is not a statement, it is evidence. Here is ours, in the open: our certifications and attestations, a live view of the controls that protect your data, the sub-processors we rely on, and an evidence room where you can pull the reports and policies you need for your own due diligence.
Independently assured, not self-declared
Every badge below is backed by a real report or certificate you can request in the evidence room. Nothing here is a logo we simply chose to display.
SOC 2 Type II Attested
Independent Type II attestation covering the Security, Availability and Confidentiality trust services criteria, examined over a rolling 12-month window.
Cyber Essentials Plus Certified
The UK NCSC-backed scheme with a hands-on technical audit of our endpoints, patching and access controls, not just a questionnaire.
CREST-guided penetration testing Annual test
Annual independent penetration testing guided by CREST methodology, with the executive summary available on request. This does not claim CREST approval or membership.
UK GDPR & DPA 2018 Compliant
A full data-subject rights workflow, a named Data Protection contact, and a Data Processing Agreement ready to counter-sign.
EU data residency Live
Customer data is stored and processed in AWS eu-west-1 (Ireland). AWS is US-owned, so the infrastructure provider is ultimately controlled by a US legal entity.
Our controls, monitored continuously
147 technical and organisational controls are checked automatically against our own platform. This is the same posture view we give every customer of their own estate, turned on ourselves.
Pull the proof you need
Request access to the reports, policies and questionnaires you need. Leave your work email and our team will follow up.
| Document | Category | Access | Get it |
|---|
Who else touches your data
A short, honest list. These are the vendors in our supply chain, what they do, and where the data sits. We notify customers before this list changes materially.
| Subprocessor | Location / Hosting | Purpose / Role | Data Processed |
|---|---|---|---|
| Amazon Web Services (AWS) | EU - Ireland; AI processing locations depend on the selected model and regional configuration | Platform hosting, storage, backups, logging and infrastructure services, including Claude through Amazon Bedrock | Platform data, customer account data, vulnerability data, system data, logs and event data, AI inputs and outputs |
| 3Gi Technology Ltd | Ireland | Associated company providing support for the RoboShadow Platform | Relevant Customer Personal Data, account information, support communications, logs, settings and Platform information, shared only as necessary to support the Platform and kept in Ireland. |
| Microsoft 365 | United Kingdom | Identity, email, collaboration, endpoint/security monitoring, Microsoft Sentinel and Defender XDR services | Business contact details, user names, email content submitted to RoboShadow, identity and security logs |
| Google Firebase / Google LLC | Google global infrastructure | Authentication and user login services, where used by the platform | User login credentials and authentication metadata |
| GitHub, Inc. | Global infrastructure | Source code repository, issue tracking, CI/CD and deployment evidence | Limited customer information where included in support tickets, bug reports, issues or deployment evidence. Customer production data is not intentionally stored in GitHub. |
| HubSpot | EU - Germany / HubSpot global infrastructure | CRM, customer communications, support and marketing activity | Customer names, business contact details, sales, marketing and support activity data |
| Stripe, Inc. | Stripe global infrastructure | Billing, payment processing, subscription management and invoicing support | Billing contact details, subscription identifiers, payment metadata and invoices. Card/payment credentials are handled by Stripe and are not stored by RoboShadow. |
| OpenAI OpCo, LLC | Global infrastructure, including processing in the United States; UK restricted transfers are governed by OpenAI’s DPA and the UK Addendum to the SCCs | AI-assisted Platform analysis, customer support and communications through ChatGPT Business or approved business APIs, subject to the AI safeguards above | Relevant account information, support communications, Customer Personal Data, logs, Platform outputs and AI inputs and outputs |
| Anthropic (direct API) | Anthropic infrastructure; processing locations are subject to the applicable provider agreement and the Data Transfers provisions of this DPA | AI-assisted analysis and related service operations through approved direct Anthropic API configurations meeting the AI safeguards above | Relevant Customer Personal Data, Platform outputs and AI inputs and outputs sent through the direct API. The CVE early-warning system sends only public vulnerability data and no Customer Personal Data. |
| SpaceXAI LLC (Grok / xAI; optional provider) | Global infrastructure, including the United States; subject to the Data Transfers provisions of this DPA | Optional AI-assisted Platform analysis and customer support through an approved business API, subject to the AI safeguards above | If used: relevant account information, support communications, Customer Personal Data, logs, Platform outputs and AI inputs and outputs. Activation is subject to the subprocessor notice and objection process. |
Trust & security FAQ
The questions security and procurement teams actually ask us, answered without the fluff.
Where is my data stored?
Can I get your SOC 2 report and pen test summary?
How is my data encrypted?
Do you run background checks and security training?
What happens if there is a security incident?
Can you complete our security questionnaire?
Request access
You are requesting this document. Leave your work email and our team will follow up.