Skip to main content
DefendDomain
Under attack?
Information security

How we protect your data

ISO 27001 and Cyber Essentials certified. We follow UK GDPR and EU GDPR, and our main database is hosted in London. This page sets out what we hold, where it is, who processes it and how we protect it.

Email our security teamSee the services we use

Ask for our ISO 27001 certificate, sub-processor list or a security questionnaire.

Citation ISO Certification: ISO 27001:2022 registered, certificate 535732026Certified
Standard
ISO/IEC 27001:2022
Certificate
535732026
Valid to
September 2027

Security at a glance

Certifications
ISO/IEC 27001:2022, certificate 535732026, issued on 10 September 2026 by Citation ISO Certification Ltd and valid to September 2027. It covers "the provision of digital risk management and security services" and can be checked on the IRQAO register. We are also Cyber Essentials certified.
Where your data is
Our main database is hosted in London (AWS eu-west-2). The services we use, listed below, are all run by US-based companies, including Supabase, which hosts that database.
What we hold
Your users' account details (name, email address, notification preferences) and the domain and threat data needed to run the service. We do not store payment card data.
Data protection
We follow UK GDPR and EU GDPR. For the personal data you put into the platform, we are the processor and your organisation is the controller.
What we can send you
Our ISO 27001 certificate, a current sub-processor list, a completed security questionnaire, and a summary of our latest penetration test under NDA.
Who owns it
Our information security policy is owned at board level and signed by our CTO, David Batey.

Where your data is stored

Our main database is hosted in London, in the AWS eu-west-2 region. Encrypted backups are stored on AWS. The services we use, listed below, are all run by US-based companies, including Supabase, which hosts our London database.

We can give prospective customers region and data-residency detail on request.

Where your data is

Main database
London ยท AWS eu-west-2
Encrypted backups
AWS
Services we use
Run by US-based companies. See the list

The services we use (sub-processors)

Every integration is outbound-only and uses credentials specific to each environment. Our main database is in London. Each of these services is run by a US-based company.

  • Supabase (on AWS)

    Database, authentication, file storage, secrets vault

    Main store for application data. AES-256 at rest, hosted in AWS eu-west-2 (London).

  • Vercel (on AWS)

    Application hosting, serverless APIs, edge network

    Hosting, WAF and DDoS protection.

  • Railway

    Always-on workers that read public threat data, such as certificate logs

    Outbound-only. Holds no personal data and has no access to the customer database.

  • Stripe

    Payment processing

    PCI DSS compliant. DefendDomain stores no card data.

  • Resend

    Transactional email and alerts

    Sends alert and account emails, so it handles the email addresses they go to.

  • Twilio

    SMS threat alerts

    Only used if you choose SMS alerts.

  • HubSpot

    CRM for prospect and customer contact data

    Holds contact details of people who fill in our forms or talk to our sales team.

  • Microsoft 365 / SharePoint

    Internal documents and email

    AES-256 / BitLocker at rest.

  • OpenAI

    AI checks on suspected fake sites

    Receives public web content, such as a suspected fake page and your public website, to check whether one copies the other. Not used to train external models.

  • Google & Bing Search

    Content search and search-engine delisting

    Used to find copies of your wording and to ask for fake pages to be removed from search results.

We can send you a current, versioned sub-processor list on request.

What data we hold, and for how long

We keep the personal data we hold to a minimum, say why we hold it, and honour data subject rights. Send erasure and privacy requests to security@defenddomain.com.

What we hold

Account information for your users, such as name, email address and notification preferences, plus the domain and threat data needed to deliver the service. We do not store payment card data.

Right to erasure

We act on valid erasure requests within the one-month GDPR deadline. We remove identifying details while keeping audit and billing records intact.

Retention

Personal data tied to a user account is kept for the life of the account plus a short wind-down period, then masked or deleted.

Backups

Personal data in backups is overwritten by our normal backup rotation, usually within 7 days.

Encryption in transit and at rest

All company and customer data is encrypted at rest and in transit. Outdated algorithms and TLS versions below 1.2 are not allowed on production systems.

How we encrypt

At rest
AES-256 or stronger, with encryption keys held in FIPS 140-2 validated hardware security modules.
In transit
TLS 1.2 or higher, with HTTP automatically redirected to HTTPS and certificates issued and renewed automatically.
Passwords
Never stored in plain text. Authentication uses salted bcrypt hashing.
Customer secrets
Webhook URLs, single sign-on settings and SIEM tokens are encrypted in a managed vault and only decrypted when they are used. We store references to them, not the secrets themselves.

Certifications

Our information security programme is independently certified to ISO/IEC 27001:2022. We are also Cyber Essentials certified, and we follow UK GDPR and EU GDPR.

ISO/IEC 27001:2022

Certified. Certificate 535732026, issued on 10 September 2026 by Citation ISO Certification Ltd, valid to September 2027 and audited every year. It covers "the provision of digital risk management and security services". You can check it on the IRQAO register.

Read how we achieved ISO 27001 in our first year.

Cyber Essentials

Certified. Cyber Essentials is the UK government-backed scheme for basic security controls such as firewalls, secure settings, access control, malware protection and patching.

UK GDPR / EU GDPR

We follow both. Our security measures are aligned to GDPR Article 32 (security of processing).

Payments: PCI DSS is handled by Stripe. DefendDomain stores no card data.

How we protect the service

What we do, day to day, to keep the platform and your data safe.

Managed cloud infrastructure

Our application, APIs, database and storage run on managed cloud services built on AWS. Always-on workers run as outbound-only containers with no path into the customer database. There is no SSH access and no public database port.

Access control and keeping customers apart

Row-Level Security on every table holding customer data means one customer cannot see another's, even if the application had a bug. Staff get the least access they need, MFA is enforced, and SAML single sign-on with roles is available.

Network security

One way in, protected by WAF rules and automatic DDoS protection. The database is never exposed directly; access goes through an authenticated gateway. Signed callbacks and rate limits on each endpoint protect internal services from tampering and replay.

Separate environments

Production and development are fully separated, each with its own credentials and data. Engineers work against a local copy of the stack, so production secrets never reach a developer's laptop.

Backups and recovery

Daily encrypted AES-256 backups with 7-day point-in-time recovery, and a multi-region edge with automatic failover. We test restoring from backup once a year and keep the results as audit evidence.

Secure development

Controls cover the whole development process, from source control to deployment and secrets management, under our Secure Development Lifecycle Policy. Every credential is specific to one environment, and access to source control and infrastructure needs MFA.

Incident management

Every incident, near-miss and false positive is logged and reviewed afterwards. Management reviews non-conformities within 24 hours, and we aim to resolve them within 30 days, sooner for high-impact or customer-facing issues.

People and training

Our team completes recurring, tracked information security training. Joining and leaving the company follow a documented checklist.

Policy statement

Scope

The scope of this policy is the development and delivery of the DefendDomain platform (https://www.defenddomain.com) by DefendDomain Ltd, including the software and systems that support it.

Information security objectives

DefendDomain Ltd is committed to protecting the confidentiality, integrity and availability of all customer data. Our information security objectives are to:

  • Achieve zero high-impact data breaches per year.
  • Build and maintain an ISMS aligned to ISO/IEC 27001:2022 and keep the certification, which requires an external audit every year.
  • Commission annual third-party penetration testing and vulnerability assessments of the platform.
  • Keep improving the ISMS, delivering at least ten Opportunities for Improvement (OFIs) each year through regular risk reviews, internal audits and management reviews.
  • Be transparent: keep an information security overview page at defenddomain.com/security and make further information available on request at security@defenddomain.com

Our ISMS provides the framework for setting, monitoring, reviewing and achieving these objectives, and leadership reviews it regularly.

David Batey

CTO, DefendDomain Ltd

Last updated 13 September 2026

Questions security teams ask us

Our main production database is hosted in London, in the AWS eu-west-2 region. Encrypted backups are stored on AWS. The services listed in the sub-processor table on this page are all run by US-based companies. We can give you full data-residency detail on request.

No. We are ISO 27001 certified (certificate 535732026) and Cyber Essentials certified, and we will complete your security questionnaire.

Questions for your security review?

Email our security team. We will answer your questionnaire and send the documents your review needs.

Email our security teamRequest a pricing call

Ask for our ISO 27001 certificate, sub-processor list or a security questionnaire. For a price, we call you within one working day.