Trust Centre
Security you can verify.
Trust is not a statement, it is evidence. Here is ours, in the open: our certifications and attestations, a live view of the controls that protect your data, the sub-processors we rely on, and an evidence room where you can pull the reports and policies you need for your own due diligence.
SOC 2 Type II
independently attested, refreshed annually
147
security controls monitored continuously
100%
of controls passing right now
46
documents in the evidence room
EU
data hosted in AWS Ireland; AWS is US-owned
Cyber Essentials Plus
independently tested and certified
Certifications & attestations
Independently assured, not self-declared
Every badge below is backed by a real report or certificate you can request in the evidence room. Nothing here is a logo we simply chose to display.
Verified
SOC 2 Type II Attested
Independent Type II attestation covering the Security, Availability and Confidentiality trust services criteria, examined over a rolling 12-month window.
2025 - 2026 reporting periodRequest report →
Verified
Cyber Essentials Plus Certified
The UK NCSC-backed scheme with a hands-on technical audit of our endpoints, patching and access controls, not just a questionnaire.
Renewed 14 Aug 2026Request certificate →
Independent
CREST-guided penetration testing Annual test
Annual independent penetration testing guided by CREST methodology, with the executive summary available on request. This does not claim CREST approval or membership.
Last test Jul 2026Request summary →
Verified
UK GDPR & DPA 2018 Compliant
A full data-subject rights workflow, a named Data Protection contact, and a Data Processing Agreement ready to counter-sign.
DPA v1.1Read the DPA →
Live
EU data residency Live
Customer data is stored and processed in AWS eu-west-1 (Ireland). AWS is US-owned, so the infrastructure provider is ultimately controlled by a US legal entity.
Region: eu-west-1See sub-processors →
Live control posture
Our controls, monitored continuously
147 technical and organisational controls are checked automatically against our own platform. This is the same posture view we give every customer of their own estate, turned on ourselves.
Last checked just now · refreshes automatically
Nothing to hide. When a control drifts, it shows here as amber before it is remediated. A perfect score is earned, not painted on.
100%
147 of 147 controls passing
Access & identity28 / 28
Encryption & key management19 / 19
Availability & resilience22 / 22
Change & release management31 / 31
Vulnerability management26 / 26
People & governance21 / 21
Evidence room
Pull the proof you need
Request access to the reports, policies and questionnaires you need. Leave your work email and our team will follow up.
| Document | Category | Access | Get it |
|---|
Sub-processors
Who else touches your data
A short, honest list. These are the vendors in our supply chain, what they do, and where the data sits.
| Subprocessor | Location / Hosting | Purpose / Role | Data Processed |
|---|---|---|---|
| Amazon Web Services (AWS) | EU - Ireland; AI processing locations depend on the selected model and regional configuration; transfer mechanism: EU-US Data Privacy Framework and UK Extension, and SCCs with the UK Addendum under the AWS DPA | Platform hosting, storage, backups, logging and infrastructure services, including Claude through Amazon Bedrock | Platform data, customer account data, vulnerability data, system data, logs and event data, AI inputs and outputs |
| DigitalOcean, LLC | United Kingdom and United States; transfer mechanism: EU-US Data Privacy Framework and UK Extension; SCCs / UK Addendum as fallback | External vulnerability scans and external penetration testing, where AWS restricts certain scanning or testing activities | Target IP addresses and hostnames, scan configuration and scan results |
| 3Gi Technology Ltd | Ireland | Associated company providing support for the RoboShadow Platform | Relevant Customer Personal Data, account information, support communications, logs, settings and Platform information, shared only as necessary to support the Platform and kept in Ireland. |
| Microsoft 365 | United Kingdom; transfer mechanism: EU-US Data Privacy Framework and UK Extension for any transfer to the United States | Identity, email, collaboration, endpoint/security monitoring, Microsoft Sentinel and Defender XDR services | Business contact details, user names, email content submitted to RoboShadow, identity and security logs |
| Google Firebase / Google LLC | Google global infrastructure; transfer mechanism: EU-US Data Privacy Framework and UK Extension | Authentication and user login services, where used by the platform | User login credentials and authentication metadata |
| GitHub, Inc. | Global infrastructure; transfer mechanism: EU-US Data Privacy Framework and UK Extension | Source code repository, issue tracking, CI/CD and deployment evidence | Limited customer information where included in support tickets, bug reports, issues or deployment evidence. Customer production data is not intentionally stored in GitHub. |
| HubSpot | EU - Germany / HubSpot global infrastructure; transfer mechanism: EU-US Data Privacy Framework and UK Extension | CRM, customer communications, support and marketing activity | Customer names, business contact details, sales, marketing and support activity data |
| Stripe, Inc. | Stripe global infrastructure; transfer mechanism: EU-US Data Privacy Framework and UK Extension | Billing, payment processing, subscription management and invoicing support | Billing contact details, subscription identifiers, payment metadata and invoices. Card/payment credentials are handled by Stripe and are not stored by RoboShadow. |
| OpenAI OpCo, LLC | Global infrastructure, including processing in the United States; UK restricted transfers are governed by OpenAI’s DPA and the UK Addendum to the SCCs | AI-assisted Platform analysis, customer support and communications through ChatGPT Business or approved business APIs, subject to the AI safeguards above | Relevant account information, support communications, Customer Personal Data, logs, Platform outputs and AI inputs and outputs |
| Anthropic (through Amazon Bedrock) | Contained within Amazon Bedrock in our AWS environment (EU - Ireland). Bedrock does not share inputs or outputs with Anthropic. | AI-assisted analysis and related service operations. Anthropic models are used and contained within Amazon Bedrock, subject to the AI safeguards above. | Relevant Customer Personal Data, Platform outputs and AI inputs and outputs processed through Amazon Bedrock. The CVE early-warning system sends only public vulnerability data and no Customer Personal Data. |
| SpaceX Super Intelligence LLC (Grok) | Global infrastructure, including the United States; transfer mechanism: EU SCCs and UK Addendum. Personal data is sent only through the provider’s zero data retention (ZDR) API | In use for AI pen test (beta) features, and available for AI-assisted Platform analysis and customer support, through an approved business API, subject to the AI safeguards above | AI pen test (beta) target inputs, scan responses and findings, and relevant account information, support communications, Customer Personal Data, logs, Platform outputs and AI inputs and outputs. |
| Eleven Labs Inc. (ElevenLabs), 169 Madison Ave #2484, New York, NY 10016, USA (no UK or EU affiliate) | United States; transfer mechanism: EU-US Data Privacy Framework and UK Extension; SCCs / UK Addendum as fallback | For an unreleased element of the platform that will use AI calls to alert engineers of security incidents. | Engineers’ phone numbers, only where the engineer has provided them and consented, and the content of alert calls and messages, including call audio and transcripts. No other contact details |
Straight answers
Trust & security FAQ
The questions security and procurement teams actually ask us, answered without the fluff.
Where is my data stored?
Customer data is stored and processed in AWS eu-west-1 (Ireland). AWS is a US-owned provider and is ultimately controlled by a US legal entity. We do not move customer data outside the EU except through named sub-processors under Standard Contractual Clauses, all of which are listed above.
Can I get your SOC 2 report and pen test summary?
Yes. Both live in the evidence room. Request access with your work email and our team will follow up.
How is my data encrypted?
Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Encryption keys are managed in AWS KMS with strict rotation and access policies, all covered under our Encryption & Key Management control set shown in the live posture panel.
Do you run background checks and security training?
Every team member completes background screening on joining and mandatory security awareness training on a recurring schedule. These sit under our People & Governance controls and are tested as part of the SOC 2 examination.
What happens if there is a security incident?
We operate a documented incident response plan with defined severities, escalation paths and customer notification timelines. The plan is available in the evidence room, and affected customers are notified in line with UK GDPR obligations.
Can you complete our security questionnaire?
Yes. Send us your questionnaire and our security contact will complete and return it quickly. The reports and policies already in the evidence room cover most of what these questionnaires ask, so it is usually a fast turnaround.
Request access
You are requesting this document. Leave your work email and our team will follow up.