# Gladstone Cloud Security, Compliance and Data Protection FAQ

HTML version: [Gladstone Cloud Security, Compliance and Data Protection FAQ](https://support.gladstonesoftware.cloud/gooperator/gladstone-cloud-security-compliance-and-data-protection-faq)

## Problem
Customers completing supplier due diligence, security reviews, or compliance assessments often have questions about Gladstone Cloud’s security, compliance, governance, and operational resilience.

## Resolution

1. **Privacy Policy**
   - Find our Privacy Policy at: [https://www.gladstonesoftware.com/gladstone-privacy-policy](https://www.gladstonesoftware.com/gladstone-privacy-policy).

2. **Security Certifications**
   - Gladstone and Gladstone Cloud currently hold:
     - ISO9001
     - ISO27001:2013
     - Cyber Essentials
     - GDPR
     - PCI
   - Gladstone Cloud is also monitored and tracked against these standards and frameworks (not officially certified):
     - CIS AKS 2.0.0
     - HIPAA
     - NIST CSF 1.1
     - SOC2 Type II
     - Microsoft Cloud Security Standards

3. **Policy Updates**
   - Gladstone undertakes quarterly ISO audits.
   - An external audit is completed once a year.
   - For the next audit date, contact Gladstone.

4. **WCAG Compliance**
   - The new GladstoneGo product will meet AA compliance in 2025.

5. **Disaster Recovery and Business Continuity**
   - **Backup and Recovery:**
     - Disaster recovery and backup procedures are formally documented.
     - System backups are automated and stored in globally redundant storage.
     - Recovery is possible from a total data centre failure.
   - **Infrastructure Resilience:**
     - Recovery processes are tested at least every six months.
     - Infrastructure is managed as code and can be redeployed if needed.
   - **Regional Failover:**
     - If the UK South data centre is unavailable for an extended period, Gladstone Cloud can redeploy to the UK West data centre within six hours.
   - **Remote Working:**
     - All staff are set up for secure remote working.

6. **Governing Body Memberships**
   - Gladstone is a proud member of the Cyber Security Council.
   - Application to the NCSC is pending.

7. **Staff Employment Checks**
   - Pre-employment and onboarding checks are performed, as recommended by ACAS.
   - Checks include right-to-work validation and identity verification.
   - Criminal conviction checks are under review as part of the NCSC application process.

8. **Data Protection Officer (DPO)**
   - Gladstone does not have a dedicated DPO.
   - DPO responsibilities are shared among the Infrastructure and Security teams.

9. **Staff Security Requirements**
   - All staff sign confidentiality and non-disclosure agreements.
   - Staff complete Data Protection and Information Security training during onboarding.

10. **Incident Management**
    - Incident-management processes are formally documented under ISO 27001.
    - Gladstone follows ICO guidance and communicates incidents affecting customer data after investigations are completed. Communication timing depends on the incident's severity.

11. **Secure Development Practices**
    - Secure development is ensured by these practices:
      - Code review and monitoring throughout development
      - Automated quality gates during the release process
      - Checks against industry best practice
      - Detection of outdated ciphers
      - Testing coverage validation
      - Load testing

12. **Legal Jurisdiction**
    - Gladstone is a UK-based company located in Wallingford, England.

## Notes

- Security certifications, memberships, and compliance statuses may change over time. Contact Gladstone if you need the latest audit dates or certification evidence.
- Incident communication timing above differs from the 24-hour notification of a confirmed breach given in [Gladstone Cloud Data Security FAQ](gladstone-cloud-data-security-faq.md). Contact Gladstone if you need the commitment that applies to your contract.
- Related articles:
  - [Gladstone Cloud Data Security FAQ](gladstone-cloud-data-security-faq.md)
  - [Gladstone Cloud Platform Security and Operational Resilience FAQ](gladstone-cloud-platform-security-and-operational-resilience-faq.md)
  - Gladstone Trust Centre
  - Gladstone Privacy Policy (linked in step 1)