Security, privacy and compliance, you can verify.
Transparency is foundational to how we operate. Explore our certifications, security practices, data handling policies and commitments to responsible AI.
- GRC and CISO
- Continuous review
- Cyber Essentials Plus
- CIS Controls v8
Find a certification, policy or control.
58 of 58 entries indexed across certifications, privacy, security, documents and AI.
- Certifications
CIS Controls (Center for Internet Security)
Numata's foundational framework for measuring the scope and maturity of the information security programme.
Open - Certifications
NIS2 Directive
Risk Management Framework aligned with the EU Network and Information Security Directive v2.
Open - Certifications
Cyber Essentials
UK government-backed certification covering firewalls, secure configuration, access controls, malware and patching.
Open - Certifications
Cyber Essentials Plus
Independent hands-on technical audit including penetration testing and vulnerability assessments.
Open - Certifications
ISO/IEC 27001
Information security programme aligned to ISO/IEC 27001 policies, controls and continuous improvement.
Open - Certifications
NIST Cybersecurity Framework
Cybersecurity practices mapped to NIST CSF: Identify, Protect, Detect, Respond, Recover.
Open - Certifications
Microsoft Solutions Partner
Recognised Microsoft Solutions Partner for Modern Work, Security and Infrastructure.
Open - Certifications
Microsoft 365 Certified
Team certifications across Microsoft 365 administration, security and compliance.
Open - Certifications
Azure Certified
Team certifications across Azure administration, security and cloud architecture.
Open - Certifications
Managed operations partner
Technical and operational certifications across remote monitoring, service automation, backup, business continuity and security tooling.
Open - Certifications
Continuity and infrastructure partner
Technical certifications across business continuity, SaaS protection and managed networking solutions.
Open - Certifications
GDPR (EU and UK)
Compliance with EU and UK GDPR including DPAs, transparent consent, subject rights and breach notification.
Open - Certifications
POPIA
Compliance with South Africa's Protection of Personal Information Act.
Open - Privacy
Lawful basis for processing
Contract performance, legitimate interest, legal obligation or explicit consent. We never sell personal data.
Open - Privacy
Data residency
Client data stored in the region closest to operations, documented in the applicable Data Processing Agreement.
Open - Privacy
Encryption standards
Secure storage, access controls and encryption governed by Numata's Encryption Policy.
Open - Privacy
Data retention
Retention periods defined per data category and documented in our retention schedule.
Open - Privacy
Breach notification
Incident Management and Response covers detection, containment, assessment, notification and remediation.
Open - Privacy
Data subject rights
Access, rectification, erasure, portability and objection. Requests processed within 30 days.
Open - Privacy
Cookie Policy
Essential, functional, analytics and marketing cookies used across the site and their retention periods.
Open - Security
Certified Chief Information Security Officer
CISO Jason Scanlon leads risk management, cybersecurity strategy, incident response and security culture.
Open - Security
Risk Management Committee
Senior management, IT leaders, compliance and department heads oversee Numata's Risk Management Framework.
Open - Security
Internal IT Governance, Risk and Compliance
GRC function conducts multiple internal audits annually to maintain continuous external audit readiness.
Open - Security
Third-Party Risk Management
Vendor and supplier risk assessed through questionnaires, interviews, onsite visits and continuous monitoring.
Open - Security
Cyber and Professional Indemnity Insurance
Cyber and PI insurance through specialist providers covering data breach, ransomware and service claims.
Open - Security
Employee Security and Training
Security education on hire, monthly and as needed, plus regular phishing simulations.
Open - Security
Intrusion Monitoring and External SOC
Threat management, intrusion monitoring and external SOC partnership for continuous coverage.
Open - Security
Endpoint Protection
Malware protection, secure configuration and centralised policy across managed devices.
Open - Security
Incident Management and Response
CISO-led plan covering detection, containment, eradication, recovery and post-incident review.
Open - Security
Vulnerability Management and Penetration Testing
Vulnerability and patch management for endpoints, servers and network, with integrated pen-testing.
Open - Security
Identity, Access and Network Security
Unique credentials, strong passwords, mandatory MFA and centrally managed SSO.
Open - Security
Business Continuity and Disaster Recovery
BC/DR plans maintained alongside the Incident Response plan and supported by GRC.
Open - Documents
Data Processing Agreement (DPA)
Standard DPA covering processing terms, sub-processors, security measures and data subject rights.
Open - Documents
Security Questionnaire
Pre-completed SIG Lite / CAIQ questionnaire covering governance, risk, access, encryption and IR.
Open - Documents
Sub-Processor List
Current sub-processors with purpose, data processed and geographic location.
Open - Documents
Security Policy
Overarching information security policy anchoring Numata's programme, aligned to CIS Controls.
Open - Documents
Acceptable Use Policy
Acceptable use of Numata-managed systems, applications and infrastructure.
Open - Documents
Artificial Intelligence Usage Policy
AI tool use within managed environments, including data classification and approved platforms.
Open - Documents
Incident Management and Response Plan
Documented plan covering detection, containment, eradication, recovery and review.
Open - Documents
Risk Management Policy
Approach to identifying, prioritising and mitigating risk across the organisation.
Open - Documents
Data Governance Policy
Data classification, ownership and governance throughout its lifecycle.
Open - Documents
Encryption Policy
Standards for encryption of data at rest and in transit across managed environments.
Open - Documents
Vulnerability Management Policy
Governance of vulnerability scanning, triage, remediation and reporting.
Open - Documents
Patch Management Policy
Standards and cadence for security and functional patching across managed estates.
Open - Documents
Change Management Policy
Governance for planned changes, including advisory board review.
Open - Documents
Asset Management Policy
How managed assets are inventoried, tracked and retired.
Open - Documents
Electronic Data Disposal Policy
Secure disposal and destruction of electronic data and media.
Open - Documents
Third-Party Risk Management Policy
How vendors and suppliers are assessed, onboarded and continuously monitored.
Open - Documents
Software Development Lifecycle Policy
Secure development practices across the software delivery lifecycle.
Open - Documents
Physical Security Policy
Controls that protect Numata premises, equipment and physical media.
Open - Documents
Business Continuity Plan
Framework for maintaining critical business services through disruption.
Open - Documents
Disaster Recovery Plan
Recovery procedures for managed infrastructure, applications and data with defined RTO/RPO.
Open - AI Pledge
Secure by Design
AI systems run within enterprise security perimeters with DLP, audit logging and access controls.
Open - AI Pledge
Data Sovereignty
Client data remains under the client's control. We never use client data to train models.
Open - AI Pledge
Transparency and Explainability
Clear documentation of AI system behaviour, limitations and decision-making processes.
Open - AI Pledge
Governance First
AI governance frameworks established before deployment: acceptable use, approved tools, oversight.
Open - AI Pledge
Human Oversight
AI augments human decision-making. Critical decisions require human review.
Open - AI Pledge
Outcome-Driven
AI deployed against measurable operational friction with defined KPIs and success metrics.
Open
Five chapters. One standard of evidence.
Each section is co-owned by GRC and its named policy owner, and updated on a continuous review cadence.
Certifications and Compliance
Our accreditations, partner certifications and compliance frameworks, including ISO alignment, Microsoft partnership and Cyber Essentials.
Data Privacy and Handling
How we collect, process, store and protect your data, including GDPR, POPIA, data residency and encryption standards.
Security Practices
Our security operations, incident response, vulnerability management and monitoring practices.
Documents and Downloads
Access our Data Processing Agreement, security questionnaire, sub-processor list and other compliance documentation.
Numata AI Pledge
Our commitment to responsible, secure and governed AI, how we build, deploy and manage AI systems for our clients.
At Numata, we are committed to building a culture of cybersecurity excellence that aligns seamlessly with the goals of our clients and organisation.
This Trust Centre is maintained by Numata’s Governance, Risk and Compliance team and reflects the current Numata Trust Centre document. It describes Numata’s practices; it is not an independent certification.
Have a security or compliance question?
Our team can respond to due diligence questionnaires, provide documentation or schedule a security review call.