Security and data
Plain-English security, for IT and procurement teams.
Our commitments
How we protect your data
Your data stays yours
For app data, the customer is the controller and Censiary is the processor, under a Data Processing Addendum.
Encryption
Data is encrypted in transit (TLS) and at rest.
Row-level security
Each customer sees only its own data. Access is role-based, per organisation.
Passwordless sign-in
The apps sign in by email one-time code — there are no passwords to steal or reuse.
Administrative access
Multi-factor authentication on all administrative accounts, least-privilege access, reviewed quarterly.
Backups and monitoring
Regular backups, logging and monitoring, and a documented incident response process.
Breach notification
Personal data breaches are notified to the customer without undue delay and within 48 hours.
Sub-processors
30 days' notice of any new sub-processor, with the right to object. A current sub-processor list is available on request.
Termination
On termination, data is returned or deleted within 30 days of the customer's election.
Audit
We provide information to demonstrate compliance, and customers may audit once a year on 30 days' notice.
Security updates
Critical and high fixes within 14 days, others within 30 days. Dependencies are reviewed monthly and before every release.
Cyber Essentials
Our security policy is built around the five Cyber Essentials controls, and we are working towards certification.
Hosting
UK/EU hosting — details on request.
How we handle personal data is set out in our Privacy Policy.
Procurement pack
Request the procurement pack
For supplier assessments and tenders, we issue a procurement pack containing:
- Security summary
- Data Processing Addendum
- Privacy Policy
- Insurance summary
- Company details
- Answers to a standard supplier questionnaire
These documents are issued individually rather than as an instant download — request the pack and it is sent by email within two working days.