Complysmart Limited Trust Hub
Who processes personal data on our behalf, and the certifications we hold.
Cyber Essentials
Complysmart Limited uses the sub-processors below to process customer personal data. For each we list what it does, where the data is processed and accessed from, how any international transfer is safeguarded, and the security and contractual safeguards in place. This register is maintained live - it is the current list.
| Sub-processor | Service / processing purpose | Processing and access locations | Transfer mechanism | Relevant safeguards |
|---|---|---|---|---|
|
Cloud / Hosting
|
Hosting of the Complysmart platform, its databases, and related cloud infrastructure.
Data: Names, email addresses, account data, compliance documents, application data, usage logs
|
United Kingdom, Ireland | None |
ISO/IEC 27001 (Information Security Management)
ISO/IEC 27017 (Cloud Security)
ISO/IEC 27018 (Protection of Personal Data in Public Clouds)
ISO/IEC 27701 (Privacy Information Management)
ISO/IEC 42001 (AI Management Systems)
ISO 22301 (Business Continuity Management)
ISO/IEC 20000-1 (IT Service Management)
ISO 9001 (Quality Management)
SOC 1 Type II
SOC 2 Type II
SOC 3
PCI DSS
CSA STAR
UK Cyber Essentials Plus
NHS Data Security and Protection Toolkit (DSPT)
FedRAMP
HITRUST CSF and BSI C5.
|
|
Cloud / Hosting
|
Provision of cloud infrastructure, application hosting, database hosting, data storage, networking and associated infrastructure services required for the operation and delivery of customer-facing applications and services.
Data: Customer names, email addresses, contact details, account identifiers, authentication data, IP addresses, application data, uploaded files, database records, technical logs and other personal data stored or processed within the hosted applications.
|
United Kingdom (London, LON1 data centre) for primary application hosting and data storage. United States and other authorised international locations for account administration, technical support and associated service operations, where applicable. | UK Addendum |
SOC 2 Type II
SOC 3 Type II
PCI DSS SAQ-A
CSA STAR Level 1
and Global Privacy Recognition for Processors (Global PRP). DigitalOcean’s underlying colocation data centres also hold certifications including ISO/IEC 27001
PCI DSS and SOC reports
although these are data-centre certifications rather than necessarily certifications held directly by DigitalOcean itself.
|
|
Cloud / Hosting
|
Provision of business email, document collaboration, cloud file storage, calendar management, video conferencing and internal communications services, which may involve processing customer personal data.
Data: Names, business email addresses, contact details, account identifiers, authentication and access information, calendar information, communications content, documents, files and associated metadata.
|
EU/EEA, UK and any other countries from which the supplier or its authorised support personnel may access personal data. | None |
ISO/IEC 27001 (Information Security Management)
ISO/IEC 27017 (Cloud Security)
ISO/IEC 27018 (Cloud Privacy)
ISO/IEC 27701 (Privacy)
SOC 2 and SOC 3 reports
|
|
SaaS Applications
|
Provision of transactional email delivery services, including sending account notifications, authentication emails, password resets, service communications and email delivery monitoring.
Data: Names, email addresses, email subject lines and message content, account identifiers, authentication and notification information, email delivery status, timestamps, IP addresses and associated message metadata.
|
European Union (Belgium - EU-hosted message data); United States and other international locations for limited account data processing, authorised support access and associated service operations. | EU SCCs |
ISO/IEC 27001
ISO/IEC 27701
SOC 2 Type I
SOC 2 Type II
HIPAA compliant
GDPR compliant
PCI-compliant SAQ-A merchant
|
|
SaaS Applications
|
Provision of workplace messaging, team collaboration, file sharing, notifications and internal communications, which may involve the processing of customer personal data.
Data: Names, email addresses, user profiles, account identifiers, messages, communications content, uploaded files, contact details, usage data and associated metadata.
|
United States (default hosting), with international processing and access as necessary for service delivery and support. | EU SCCs |
ISO/IEC 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
ISO/IEC 42001
SOC 2 Type II
SOC 3
CSA STAR
Global PRP and Global CBPR certifications. Slack also maintains FedRAMP authorisations for relevant services.
|
|
SaaS Applications
|
Processing of customer payments, subscription billing, invoicing, refunds, payment authentication, fraud prevention and associated financial transactions.
Data: Customer names, email addresses, billing addresses, payment card details, bank account information, transaction records, invoice details, subscription information, payment identifiers, IP addresses and fraud prevention data.
|
United States, European Economic Area (EEA) and other international locations where Stripe affiliates and authorised service providers process or access personal data. | EU SCCs |
PCI DSS Level 1
ISO 27001
SOC 1 Type II
SOC 2 Type II
SOC 3
|