Security, compliance and the answers RFPs always ask

This page is the canonical place to see how Vitalytics handles your data, what we're certified against today, what we're working towards, and which sub-processors touch your information. Procurement teams should be able to lift this straight into a vendor questionnaire.

Last reviewed: 2026-04-25 · Next review: 2026-07-25

Certifications & frameworks

ISMS scope

The Vitalytics Information Security Management System covers all client-facing managed-IT services delivered from our UK and EU operations, including:

• Endpoint, identity, email and network management;
• Cloud infrastructure on Microsoft Azure and the Vitalytics private OpenStack cloud (UK, EC1);
• Service desk and incident response, on-call and out-of-hours;
• Backup, BCDR and immutable storage operations.

Out of scope: the public Vitalytics website (this site), the Cloudflare DNS zone for vitalytics.co.uk, and any client-controlled SaaS the client has not asked us to administer.

Sub-processors

The following processors handle client data on our behalf. We provide 30 days' notice of any addition via this page and to named compliance contacts.

Encryption

• In transit: TLS 1.2 minimum, TLS 1.3 preferred. HSTS preload on this domain. mTLS between internal services.
• At rest: AES-256 on all managed storage (Cinder NVMe, NFS, Azure Storage), customer-managed keys available for ISO-27001-scope clients on request.
• Key management: Vitalytics-operated HashiCorp Vault (OpenBao) with sealed root, daily key rotation logged.

Identity & access

• SSO via Authentik (OIDC + SAML) for all internal tools, with WebAuthn / passkeys enforced for staff with elevated access.
• JIT elevation for engineers; standing admin rights only for break-glass accounts (audited monthly).
• Quarterly access reviews; terminations propagated within 4 working hours of HR notice.

Business continuity & disaster recovery

Off-site backup target: Backblaze B2 (UK) — rolling out Q2 2026. Until then, backups are held on a second physical site within EC1.

Incident response

• Severity P1 (service down or confirmed breach): 15-min initial response, 1-hour status update cadence, postmortem within 5 working days.
• Severity P2 (significant degradation): 1-hour response, 4-hour update cadence.
• Severity P3 (minor or single-user): next business day.
• Customer notification of any incident affecting their data within 24 hours of confirmation, regardless of severity.

Live status page: vitalytics.co.uk/status. Subscribe via the RSS link there for incident notifications.

Vulnerability management

• Patching: critical CVEs within 72 hours, high within 7 days, medium within 30 days.
• Penetration testing: annual external test (next: October 2026); internal architecture review every 6 months.
• Coordinated disclosure: security@vitalytics.co.uk · /.well-known/security.txt (publishing soon).

Documents available under NDA

• Data Processing Addendum (UK GDPR + standard contractual clauses).
• ISMS scope statement & document register.
• Information Security Policy.
• BCDR plan with last-test evidence.
• Sub-processor list (this page's contents in PDF form).
• SOC 2 readiness gap assessment (once complete).

Email security@vitalytics.co.uk for a copy.

Compliance mappings

How our controls map to the frameworks your auditor will know:

Questions about our security posture?

Email security@vitalytics.co.uk. We respond within one UK working day.