SECURITY & COMPLIANCE
How your ceremony data is hosted, encrypted and access-controlled — and, in the same place, what we do not have yet. Both halves are the point.
INFRASTRUCTURE
- The application runs on Render, in Render’s Frankfurt region. The database is Aiven managed MySQL, reached over TLS. Both are within the European Economic Area.
- Personal data is processed within the European Economic Area
- 99.9% monthly uptime target — see Support for the response targets and Terms §10 for the service credit
- Encrypted daily backups — see Retention below
- Infrastructure monitored with automated alerting; incidents are posted to our status page
ENCRYPTION
- All data encrypted in transit (TLS 1.2 or higher)
- All data encrypted at rest (AES-256)
- Database connections use TLS with a pinned provider CA
- API keys and secrets held as environment variables, never in the codebase
- Passwords hashed with bcrypt
RETENTION AND DELETION
- After cancellation, your data is retained for 90 days for export, then permanently deleted from primary databases
- Backups are encrypted and taken daily. They expire automatically on a rolling window set by our database provider, which means a record deleted from the live platform remains inside unexpired backups until the last backup containing it rolls off. Backups are never used to restore deleted customer records to the live platform. We are confirming the exact retention window with the provider and will publish it here once it is confirmed.
AUTHENTICATION & ACCESS
- Role-based access control (RBAC) with granular permissions
- Sessions are signed server-side; the session cookie cannot be edited or forged in the browser
- Demo and trial requests are email-verified before access is granted
- Every request is scoped to one organisation before any data is read
DATA PROTECTION & GDPR
- UK GDPR and Data Protection Act 2018 compliant
- Data Processing Agreement available on request — see Documents below
- Right to erasure ("right to be forgotten") supported
- Data portability: full export in standard formats (CSV, PDF)
- Sub-processors disclosed on our GDPR page
- Data protection contact: our Data Protection Lead at privacy@accolade.live
APPLICATION SECURITY
- Multi-tenant isolation: every record carries an organisation ID and every query filters on it server-side
- Input validation and parameterised queries (SQL injection prevention)
- Output encoding on user-supplied content
- HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy set on every response
- Content-Security-Policy — see the note below for exactly what it does
What our Content-Security-Policy actually does. Public
pages are served with an enforced CSP. It pins default-src
and connect-src to our own origin, sets
object-src 'none' and base-uri 'self',
restricts form-action to our own origin and restricts who
may frame us. In practice that blocks plugin injection, the
<base> tag hijack that rewrites every relative URL on
a page, and an injected form posting your credentials somewhere else.
It does not block inline script execution. Our pages are
hand-written HTML with inline styles and scripts, so the policy still
carries 'unsafe-inline' on script-src. That is
CSP's strongest anti-XSS mechanism switched off, and we would rather
tell you that than describe the header as "enforced" and let you assume
otherwise. Removing it means moving every inline script in the product
behind a per-request nonce; it is on the roadmap below.
The customer workspace and the room planner receive the same policy in report-only mode, because enforcing it there before it has been verified is how a page breaks at 7pm on an event day.
INCIDENT RESPONSE
- Documented incident response procedure
- Security incidents communicated to affected customers within 24 hours of confirmation
- Personal data breaches notified to the affected controller within 72 hours (UK GDPR Art.33)
- Post-incident reports provided to affected customers
- Vulnerability disclosure: security@accolade.live, with a 90-day disclosure window
CERTIFICATION STATUS
Plain statement first: we hold none of the certifications below today. This section describes work in progress, not credentials.
- SOC 2 Type I — In progress. No SOC 2 report has been issued and we do not hold SOC 2 Type II.
- ISO 27001 — Planned. Not held today.
- Cyber Essentials Plus — In progress. Not held today.
ROADMAP — CONTROLS WE DO NOT HAVE YET
Published because a buyer's security questionnaire will ask, and because finding out from us is better than finding out from a penetration test.
Two-factor authentication. Not available today, on any plan. Earlier versions of this page and of our GDPR page said otherwise; that was wrong and has been corrected.
CSRF tokens on state-changing requests. Not implemented today. An earlier version of this page listed this as an existing control.
A nonce-based Content-Security-Policy. See the note above. Today's policy permits inline script.
SSO (Google Workspace, Microsoft Entra). Sold as an Enterprise feature in our plan configuration. If you are evaluating Accolade on the strength of SSO, ask us for its current status before you sign — do not take it from this page.
DOCUMENTS
DATA PROCESSING AGREEMENT
Our standard DPA for customers who process personal data through Accolade. Not yet published as a self-serve download; request it and we will send the signed copy.
Request the DPA →SUB-PROCESSOR LIST
Who we engage, what for, and where they process. Published in full on our GDPR page — no request needed.
View the list →SECURITY QUESTIONNAIRE
Send us your standard questionnaire (CAIQ, SIG-Lite or your own) and we will complete it, including the gaps listed above.
Send it to us →QUESTIONS ABOUT SECURITY?
Talk to us before you fill in the questionnaire. We will answer the gaps as directly as this page does.