FAQ: Security & Privacy

Our risk management-oriented programme – led by our Chief Information Security Officer (CISO) – aims to continuously implement industry best practices across people, process and technology.  To ensure impartial oversight, the CISO reports to the Board on a regular basis.

As part of the CISO’s programme, we leverage various policies and controls, such as in-transit and at-rest data encryption, tight access controls and strong authentication, network/infrastructure/application-layer security, and incident response.

These governance measures ensure security and privacy are in practice across the breadth of our operations and software development processes.

Yes. As standard, we monitor key controls and review access on a regular basis, and have achieved SOC 2, ISO27001 and the Cyber Essentials certification.

Meanwhile, we continue to progress our Governance, Risk and Compliance (GRC) programme in 2024, focusing on globally-recognised frameworks such as ISO27701 to further assure customers of our commitment to security and privacy as core pillars of trust.

Data is encrypted in-transit using TLS1.2, and at-rest with AES. We use best-in-class database encryption, as well as implementing data segregation and role separation to enforce the principle of least privilege across our multi-tenant architecture.

Access is controlled via tight access control technical policies and strong authentication, with data masking available within the product where required.  We have standard backup and data retention practices, and we proactively monitor component and system status.

Following Microsoft’s Azure ‘Well-Architected’ framework, Surveil delivers high performance and availability with redundancy and resilience built in.  This is underpinned by change and release management processes to keep quality and service availability high.

We us the agile product delivery framework, automated code review, and security assessment before entering the pipeline to Production. In our CI/CD pipeline process, only code reviewed after successful completion of all automated tests is permitted for production deployment to ensure ultimate consistency across all Surveil instances.

Secure storage of code in escrow is also available if required.

Surveil SaaS is derived from a container-based platform, with segmentation applied between running micro-services internally and externally, from the front-end application firewall, through the API integrations, to the database layers.

We enforce privileged identity and access management for alignment with the principle of least privilege approach to access. Vulnerability management is performed externally and internally, with a regular patching schedule for the non-SaaS/PaaS components we manage.

Surveil is a ‘born-in-the-cloud’ business with staff-only laptops working flexibly around the world using endpoint protection and management, disk encryption, strong authentication, and automated mandatory patching.

Additionally, staff must complete cyber and privacy awareness training which is assigned on a regular basis.

Our security team leverages automation across the majority of our platform, from controls, efficacy, and compliance to design, and the frameworks and certifications we are working towards.  The security team performs periodic reviews across the business, and manages external audits and penetration tests when scheduled.

We have cloud-based log capture, consolidation, and analysis – with advanced tooling to help scope tasks and investigations.  We review the vulnerability management tooling and prioritise remedial action as appropriate, based on the risk assessment and threat landscape considerations.

The team also run security incident response with scheduled exercises to validate our playbooks, investigation, mitigation, and recovery effectiveness.  They coordinate with management, operations, development, and – as needed – our customer services teams to ensure communications are accurate, timely and transparent.

Frequent configuration and data backups are performed and securely stored in different cloud datacentres.  The team perform regular recovery verification tests to ensure data integrity and Surveil availability to service level agreements (SLA).