SECURITY & COMPLIANCE

INFRASTRUCTURE

• Hosted on AWS EU-West-2 (London) region
• All data stored within the United Kingdom
• 99.9% uptime SLA for Professional and Enterprise tiers
• Automated daily backups with 30-day retention
• Point-in-time recovery available
• Infrastructure monitored 24/7 with automated alerting

ENCRYPTION

• All data encrypted in transit (TLS 1.3)
• All data encrypted at rest (AES-256)
• Database connections use SSL/TLS
• API keys and secrets stored in encrypted vaults
• Passwords hashed with bcrypt (minimum 12 rounds)

AUTHENTICATION & ACCESS

• Email verification required for all accounts
• Two-factor authentication (2FA) available on all plans, enforced on Enterprise
• Role-based access control (RBAC) with granular permissions
• Session timeout after 30 minutes of inactivity
• IP whitelist available on Enterprise tier
• SSO support (Google Workspace, Microsoft Entra) on Enterprise tier

DATA PROTECTION & GDPR

• GDPR compliant from day one
• UK Data Protection Act 2018 compliant
• Data Processing Agreement (DPA) available on request
• Right to erasure ("right to be forgotten") supported
• Data portability: full export in standard formats (CSV, JSON)
• Consent logging for all personal data collection
• Sub-processors disclosed and updated quarterly
• UK-based Data Protection Officer contactable at dpo@accolade.live

APPLICATION SECURITY

• Regular penetration testing by independent third parties
• OWASP Top 10 protections built into the application layer
• Content Security Policy (CSP) headers enforced
• Rate limiting on all API endpoints
• Input validation and parameterised queries (SQL injection prevention)
• XSS protection via output encoding
• CSRF tokens on all state-changing requests

INCIDENT RESPONSE

• Documented incident response procedure
• Security incidents communicated within 24 hours of confirmation
• Post-incident reports provided to affected customers
• Vulnerability disclosure: security@accolade.live
• Responsible disclosure programme (90-day disclosure window)

COMPLIANCE ROADMAP

• SOC 2 Type I: in progress (expected Q4 2026)
• ISO 27001: planned (2027)
• Cyber Essentials Plus: in progress

DOWNLOADS