Security at AIZAINOS

Last updated: 1 January 2027

AIZAINOS LTD protects customer data with layered controls designed around ISO/IEC 27001:2022, the UK National Cyber Security Centre’s Cyber Essentials scheme and the OWASP Application Security Verification Standard. This page describes those controls, how to report a vulnerability, and how we respond to incidents. It supports our duty under Article 32 UK GDPR to keep personal data secure.

Drafting note: only state a certification (ISO 27001, Cyber Essentials Plus, SOC 2) once you hold the certificate. Until then, keep the wording “designed around”.

1. Infrastructure and hosting

  • Hosted on Microsoft Azure in [Hosting region], in data centres certified to ISO/IEC 27001, SOC 1/2 and the CSA STAR standard.
  • Production, staging and development environments are separated; real customer data is never used in development.
  • Databases run on Azure Database for PostgreSQL with private networking, no public endpoint, and automated patching.
  • Web traffic passes through a web application firewall with DDoS protection.

2. Encryption

Where

How

In transit

TLS 1.2 or higher, HSTS enforced, modern cipher suites only

At rest

AES-256 for databases, files and backups

Secrets and keys

Stored in Azure Key Vault, rotated at least every 12 months

Passwords

Never stored in plain text; hashed with a modern adaptive algorithm (Argon2id or bcrypt)

3. Access control

  • Single sign-on and multi-factor authentication available for every customer; MFA required for all AIZAINOS staff.
  • Role-based permissions let your administrators grant each user only what they need.
  • Staff access to production follows least privilege, is approved per need, time-limited and logged.
  • Access is reviewed every quarter and removed within 24 hours when someone leaves.

4. Application security

  • Secure development lifecycle: peer code review, automated static analysis and dependency scanning on every change.
  • Testing against the OWASP Top 10, including injection, broken access control and cross-site scripting.
  • Independent penetration test at least once a year and after major releases. A summary is available to customers under NDA.
  • Tenant isolation ensures one customer can never access another’s data.

5. Monitoring and logging

We log authentication, administrative actions and data access, keep logs for 12 months, and alert our team to suspicious activity around the clock. Customer administrators can view an audit log of activity in their own account.

6. Backups and resilience

We back up databases continuously with point-in-time recovery for 35 days, store copies in a second UK region, and test restoration at least twice a year. Our recovery targets are [4] hours to restore service and no more than [15] minutes of data loss.

7. People and suppliers

  • All staff pass background checks appropriate to their role, sign confidentiality agreements and complete security and data protection training at least once a year.
  • Every supplier that handles customer data is assessed before use, signs a data processing agreement, and is reviewed every year. Our sub-processor list is at [domain]/subprocessors.

8. Incident response

We keep a tested incident response plan. If a security incident affects your data, we will:

  1. contain it and begin investigation immediately;
  2. notify affected customers without undue delay, and within 48 hours of confirming a breach of their data;
  3. report to the Information Commissioner’s Office within 72 hours where the law requires;
  4. share what happened, what data was involved and what we are doing about it;
  5. review the incident and fix the root cause.

9. Report a vulnerability

We welcome reports from security researchers. Email [security@domain] (our details are also at [domain]/.well-known/security.txt) with a description, the steps to reproduce it and its potential impact.

We will acknowledge your report within 2 working days, keep you updated, and credit you if you wish. If you act in good faith, do not access or change more data than needed to show the issue, do not disrupt our service, and give us reasonable time to fix it before disclosing it, we will not take legal action against you.

Please do not run denial-of-service tests, social engineering, physical attacks or automated scans that harm the service.

10. Your part

Security is shared. Please switch on MFA, use strong unique passwords, remove users who no longer need access, and tell us at once if you suspect misuse of your account.

11. Contact

Security questions: [security@domain] · AIZAINOS LTD, The Club House, 304 Anchor Road, Longton, Stoke-on-Trent ST3 5DN

Drafting note: check every control listed against what is actually built before publishing — describing a control you do not have is a misrepresentation.