Gladstone Cloud Security, Compliance and Data Protection FAQ

Problem

Customers completing supplier due diligence, security reviews, or compliance assessments often have questions about Gladstone Cloud’s security, compliance, governance, and operational resilience.

Resolution

1. Privacy Policy

   • Find our Privacy Policy at: https://www.gladstonesoftware.com/gladstone-privacy-policy.

2. Security Certifications

   • Gladstone and Gladstone Cloud currently hold:
     • ISO9001
     • ISO27001:2013
     • Cyber Essentials
     • GDPR
     • PCI
   • Gladstone Cloud is also monitored and tracked against these standards and frameworks (not officially certified):
     • CIS AKS 2.0.0
     • HIPAA
     • NIST CSF 1.1
     • SOC2 Type II
     • Microsoft Cloud Security Standards

3. Policy Updates

   • Gladstone undertakes quarterly ISO audits.
   • An external audit is completed once a year.
   • For the next audit date, contact Gladstone.

4. WCAG Compliance

   • The new GladstoneGo product will meet AA compliance in 2025.

5. Disaster Recovery and Business Continuity

   • Backup and Recovery:
     • Disaster recovery and backup procedures are formally documented.
     • System backups are automated and stored in globally redundant storage.
     • Recovery is possible from a total data centre failure.
   • Infrastructure Resilience:
     • Recovery processes are tested at least every six months.
     • Infrastructure is managed as code and can be redeployed if needed.
   • Regional Failover:
     • If the UK South data centre is unavailable for an extended period, Gladstone Cloud can redeploy to the UK West data centre within six hours.
   • Remote Working:
     • All staff are set up for secure remote working.

6. Governing Body Memberships

   • Gladstone is a proud member of the Cyber Security Council.
   • Application to the NCSC is pending.

7. Staff Employment Checks

   • Pre-employment and onboarding checks are performed, as recommended by ACAS.
   • Checks include right-to-work validation and identity verification.
   • Criminal conviction checks are under review as part of the NCSC application process.

8. Data Protection Officer (DPO)

   • Gladstone does not have a dedicated DPO.
   • DPO responsibilities are shared among the Infrastructure and Security teams.

9. Staff Security Requirements

   • All staff sign confidentiality and non-disclosure agreements.
   • Staff complete Data Protection and Information Security training during onboarding.

10. Incident Management

    • Incident-management processes are formally documented under ISO 27001.
    • Gladstone follows ICO guidance and communicates incidents affecting customer data after investigations are completed. Communication timing depends on the incident's severity.

11. Secure Development Practices

    • Secure development is ensured by these practices:
      • Code review and monitoring throughout development
      • Automated quality gates during the release process
      • Checks against industry best practice
      • Detection of outdated ciphers
      • Testing coverage validation
      • Load testing

12. Legal Jurisdiction

    • Gladstone is a UK-based company located in Wallingford, England.

Notes

• Security certifications, memberships, and compliance statuses may change over time. Contact Gladstone if you need the latest audit dates or certification evidence.
• Incident communication timing above differs from the 24-hour notification of a confirmed breach given in Gladstone Cloud Data Security FAQ. Contact Gladstone if you need the commitment that applies to your contract.
• Related articles:
  • Gladstone Cloud Data Security FAQ
  • Gladstone Cloud Platform Security and Operational Resilience FAQ
  • Gladstone Trust Centre
  • Gladstone Privacy Policy (linked in step 1)

This page as markdown · All pages · llms.txt