Privacy & Data Protection

Built around customer control

Our approach to privacy starts with a simple principle: process only the personal data that is needed, for a clear purpose, and keep customers in control of it.

That principle carries through the full data lifecycle - from how information is collected and accessed to how it is retained and deleted. Privacy considerations are built into our products, services and operational processes, including the way we work with third-party providers.

How we approach personal data

These principles apply to data we process on behalf of customers and to data we hold as a business in our own right.

Data minimisation

We collect and retain the minimum personal data needed for a defined purpose, and our products make it straightforward for customers to do the same.

Security by default

Encryption, access control and audit logging apply to personal data by default, with no configuration required to reach a secure baseline.

Transparency

Our privacy notice, subprocessor list and processing terms are published, and material changes are notified in advance rather than announced afterwards.

Purpose limitation

Data supplied for support, training or professional services is used only for that engagement. It is never repurposed for product development or marketing.

Data sovereignty

Customers choose where their data is stored and processed. On-premises deployments don't transmit data to us automatically. The only customer data we receive is what you send us deliberately, such as a log file attached to a support case.

Deletion on exit

On termination, customer data is deleted to a documented schedule, with written confirmation of destruction provided on request.

Key documents

Document
Data Processing Addendum \| EU/UK	Download
Data Processing Addendum \| USA	Download
Data Processing Addendum \| APAC	Download
Privacy Policy	Read
Cookie Policy	Read

Need more detailed assurance?

Procurement and assurance teams can access our full security documentation on Risk Ledger, including our SOC 2 report, ISO certificates and policies. If your review needs something we haven't published there, raise a support case and we'll confirm what we can provide.

Access our Risk Ledger profile

Raise a Support Case