Security Overview

Protecting your information.
Supporting your confidence.

Explore the security controls behind ISMS Workspace and the security principles that guide DPS Compliance Hub: UK hosting, encryption, multi-factor authentication and controlled access.

Illustrative workplace photograph for Security Overview

Security at a glance

Primary hosting

Azure UK

Application and primary customer data hosted in Microsoft Azure UK South.

Encryption at rest

AES-256

256-bit encryption protects the managed database and its Azure backups.

Encryption in transit

TLS 1.2+

HTTPS for browser access and verified TLS connections to the database.

UK cloud infrastructure

A managed foundation
for your workspace.

The production ISMS platform runs on Azure App Service and Azure Database for MySQL in UK South. Azure provides the underlying datacentre security and managed hosting infrastructure; DPS manages the application, its configuration and workspace permissions.

The database uses private network connectivity. Each production client has a separate database and application identity, with access restricted to its own database and secrets. Client isolation checks have confirmed that those identities cannot access another client’s database or secret store.

Secrets are held in Azure Key Vault with role-based access, private connectivity, soft-delete retention and purge protection. Credentials are kept out of the public website and client-facing browser code.

UK hosting refers to the application and primary customer data. Identity, email and any AI or external integrations have their own processing arrangements, described in the applicable service and data processing information.

Protecting stored and transmitted data

Encryption throughout the core service.

Data at rest

Azure Database for MySQL encrypts stored data, temporary database files and backups using AES with 256-bit keys. Azure manages the storage encryption keys.

Data in transit

Workspace browser connections use HTTPS, with TLS 1.2 as the minimum configured version. Application-to-database connections also require TLS 1.2 or later and validate the server certificate and hostname.

Technical references: Microsoft’s MySQL security overview ↗ · Azure App Service security ↗

Identity and access

Authenticated users.
Authorised access.

Authentication confirms who you are. Authorisation determines which client workspace, content and actions you can access. Signing in alone does not grant permission to a workspace.

Two-factor authentication

Production ISMS sign-in uses Microsoft Entra ID with an enabled policy requiring multi-factor authentication (MFA), including for guest users. Users verify their identity through two factors, such as their password and an approved authenticator method. The identity provider can recognise a valid existing MFA session.

Server-side permission checks

Access checks use the authenticated session, active account, client membership and assigned workspace role. They run on the server for protected operations, including viewing content, editing records, approving documents and managing access.

Controlled administration

DPS Admins manage authorised client accounts across the platform. Client Admins manage users and roles within their own organisation. Administrative access is separate from ordinary member and read-only access.

Auditors and access changes

External auditors can receive read-only access with an expiry date. Administrators can amend or withdraw workspace permissions. Access changes are recorded in the workspace’s audit history.

Availability and recovery

Dependable service.
Defined recovery commitments.

Our workspace terms define a minimum service availability of 95%, with a 99.9% availability objective, a 24-hour recovery point objective and an 8-hour recovery time objective. These service commitments give customers a clear basis for continuity planning.

Monthly availability objective

99.9%

Our availability objective supports reliable access, backed by a contractual minimum of 95%. The service terms define measurement and applicable exclusions.

Recovery point objective · RPO

24 hours

Our recovery point objective limits the target age of recoverable customer data to 24 hours. RPO describes the amount of recent work that could need to be re-entered following an incident.

Recovery time objective · RTO

8 hours

Our recovery time objective is 8 hours for restoring the core service following a confirmed disruption, within the recovery scope defined in the service terms.

Azure availability

Microsoft advertises a 99.95% infrastructure SLA for eligible Azure App Service hosting. That figure applies to the hosting component, not the combined availability of the workspace, database, authentication and integrations.

Azure App Service availability ↗

Backups and restore points

The ISMS database has a 35-day backup retention window and supports point-in-time recovery. Azure documents daily snapshot backups and transaction-log backups every five minutes; that database capability does not establish a five-minute RPO for the whole service.

Azure database backup and restore ↗

Support and service continuity

UK hosting and technical support are included in the workspace licence. Our support-ticket response SLA is 24 hours, and routine maintenance and updates take place at weekends. Recovery covers the core application, database and required configuration; the applicable service terms explain dependencies, exclusions and the recovery scope.

DPS Compliance Hub

Security built into
our service approach.

Information security and data protection inform how we design and manage our workspace services. Clear responsibilities, controlled access and documented processing arrangements help organisations assess the service with confidence.

The technical controls described on this page reflect the production ISMS Workspace. Our Privacy & GDPR overview explains the wider DPS Compliance Hub approach to personal data, and our workspace terms define each service’s contractual commitments.

Contact DPS for assurance information relevant to ISMS Workspace, PIMS Workspace or Data Privacy Workspace and your organisation’s requirements.

Your security questions

Make an informed decision.

Discuss your assurance requirements, data processing arrangements and service scope with DPS.

Discuss security

Protecting your information.Supporting your confidence.