Security and data protection
How customer data in Digital Training Centre is hosted and protected. Last updated 9 October 2026.
Hosting
All customer data is stored in the UK (London): database, files and logins with Supabase, the application with Vercel. Both hold ISO 27001 and SOC 2 Type II certifications. No customer data or secrets are kept in source code.
Controls
- Organisation separation enforced by PostgreSQL row-level security, tested on every change.
- Invite-only accounts, role-based access checked in the app and the database, optional enforced two-step login.
- HTTPS only (HSTS), AES-256 encryption at rest, third-party tokens encrypted again.
- Security headers on every page, protected exports and safe redirects.
- Activity log of changes to settings, team, certificates and documents.
- Daily backups, and a weekly off-site export.
Change control
Every change goes through review and automated checks (lint, type checks, unit tests, database security tests and a build) before release. Dependencies are monitored weekly. A full code security review was completed in October 2026.
Reporting a concern
Sector 3 Group Ltd is registered with the ICO (ZC039177). Email miles.ward@sector3group.co.uk. We aim to reply within one working day. A security questionnaire and Data Processing Agreement are available on request.