Every policy, credential and control, in one place.
We build and host systems that run sport governing bodies, healthcare providers and regulated businesses. They ask hard questions about security and governance before they sign, and so should you.
This page is the single destination for how we answer them: our certifications, the policies we work to, who is accountable, and where your data lives. If something you need is not here, ask and we will add it.
What we commit to.
UK
Data residency by default
24h
Incident notification commitment
99.9%
Hosting availability target
30
Days' notice before any sub-processor change
Certifications and accreditations
Independently assessed, renewed on a fixed cadence, and listed here with the date of the last audit so you can see how current each one is.
Cyber Essentials
Sophlee Limited for IASME (NCSC scheme)
Reference aa1b8223-8ccc-48a1-bf4d-6edab45490e5
UK government-backed baseline controls against common cyber attacks, certified across the whole organisation.
ISO 27001
Placeholder certification body
Information security management across our delivery, hosting and support services.
SOC 2 Type II
Placeholder audit firm
Security, availability and confidentiality controls, observed over a twelve-month period.
Policies and documents
Public policies download directly. Assurance documents that reference our infrastructure are shared under NDA within one working day of a request.
Policies
- Privacy policyPlaceholder
How we collect, use and protect personal data as a controller and a processor.
Last updated 1 Sept 2026 - Information security policyPlaceholder
The controls, roles and standards that govern how we build, host and support systems.
Last updated 15 July 2026 - Acceptable use policyPlaceholder
What clients and staff may and may not do on systems we host or operate.
Last updated 20 May 2026 - Data retention and deletionPlaceholder
How long we keep each class of data and how it is securely destroyed.
Last updated 10 Apr 2026 - Modern slavery statementPlaceholder
Our annual statement under section 54 of the Modern Slavery Act 2015.
Last updated 31 Jan 2026
Assurance documents
- Penetration test summaryPlaceholder
Executive summary of the most recent independent test and remediation status.
Last updated 12 Aug 2026 - Data processing agreementPlaceholder
Our standard DPA, including UK GDPR Article 28 terms and international transfer clauses.
Last updated 1 Feb 2026 - Business continuity and disaster recovery planPlaceholder
Recovery objectives, backup strategy and the last full restore test.
Last updated 30 June 2026 - Insurance certificatesPlaceholder
Professional indemnity, public liability and cyber cover.
Last updated 15 Sept 2026
How we handle your data.
Encryption everywhere
TLS 1.2+ in transit and AES-256 at rest for every system we host, including backups.
Least-privilege access
Named accounts, MFA for every engineer, and access reviewed quarterly and on every leaver.
UK hosting
Production systems and backups stay in UK data centres unless a client asks otherwise in writing.
Tested, not assumed
Independent penetration tests annually, vulnerability scanning continuously, patches within agreed SLAs.
Governance
Security and compliance are owned by named people with a fixed review cadence, not left to whoever is nearest.
- Executive owner
- Managing DirectorAccountable for the information security management system (placeholder).
- Information security lead
- Head of EngineeringRuns the risk register, incident response and supplier reviews (placeholder).
- Data protection
- Data Protection LeadFirst point of contact for data subject requests and DPIAs (placeholder).
- ICO registration
- ZC272090Registered with the Information Commissioner's Office until 11 Oct 2027, renewed annually.
- Internal audit
- QuarterlyControl effectiveness reviewed against the ISO 27001 statement of applicability.
- External audit
- AnnuallySurveillance audit each year, full recertification every three years.
- Policy review
- Annually, or on material changeEvery policy carries its last-reviewed date on this page.
Company details
The registered details procurement and supplier onboarding teams usually ask for.
- Company name
- Neptune Digital Ltd
- Company number
- 14482756Registered in England and Wales
- VAT number
- 428 3090 03
- D-U-N-S number
- 230113499
- Registered office
- 5a Brook Street, Manningtree, England, CO11 1DJ
Sub-processors and data residency
The third parties that may process client data on our behalf, what they do and where the data lives. We give 30 days' notice before adding one.
- Cloud hosting
- Placeholder hosting providerFileMaker Server and web hosting · United Kingdom
- Backups
- Placeholder storage providerEncrypted offsite backups · United Kingdom
- Email and collaboration
- Microsoft 365Email, Teams and document storage · United Kingdom / EU
- Support desk
- Placeholder helpdesk providerTicket content and attachments · EU
- Monitoring
- Placeholder monitoring providerUptime and error telemetry, no personal data · EU
Under NDA
Need the full audit report, pen test or continuity plan?
Tell us who you are and what you are assessing. We will send a mutual NDA and share the documents within one working day.