Trust & security

Security at ISOvault

Last updated: 6 July 2026

You are trusting us with the records of your information security management system. That is not lost on us. This page explains how ISOvault protects your data, in the same plain terms we would expect from our own suppliers.

The fundamentals

UK hosted, encrypted everywhere, isolated by design.

UK data residency

All customer data, documents and backups are hosted in AWS data centres in London (eu-west-2). Your ISMS never leaves the UK for storage.

AWS facilities hold ISO 27001, SOC 2 and equivalent certifications.

Encryption in transit and at rest

TLS 1.2 or higher for every connection. AES-256 encryption at rest across databases, document storage and backups. No exceptions, no legacy endpoints.

Isolated tenancy

Every customer has an isolated database schema and isolated, tenant-namespaced document storage. Your data is structurally separated from other customers', not just filtered by a query.

Access control

Authentication is handled by Auth0, with single sign-on and multi-factor authentication. Inside your workspace, your administrators control who sees and edits what.

Our own administrative access to production is restricted, MFA-protected and logged.

Backups that restore

Automated backups with point-in-time recovery for every customer database. Restores are tested on a schedule, because a backup you have never restored is a hope, not a control.

Documents handled properly

Documents live in isolated object storage, never in the database, and are served only through short-lived signed URLs. Storage is never publicly accessible.

We use our own product

ISOvault runs its ISMS on ISOvault.

Our risk register, asset register, supplier reviews and policies are managed in the same product you are evaluating, and we are working toward Cyber Essentials certification for ISOvault itself. When we make a security decision, we feel it as a customer first. Our supply chain is deliberately short, and every provider in it is published in our sub-processor register.

AI features and your data

ISOvault's AI gap analysis reads your ISMS content to give you a genuine opinion on where you stand. Three commitments on how that works:

  • AI processing never leaves the UK. We run Claude models through Amazon Bedrock inside our own AWS environment in London (eu-west-2). Your content is not sent to an AI company's servers.
  • Your data is never used to train AI models. Model providers on Amazon Bedrock cannot access customer inputs or outputs.
  • AI features are part of the product, not a data business. There is no secondary use of your content, full stop.

Development practices

  • Segregated development, staging and production environments.
  • Customer data is never used in development or testing.
  • Error tracking and security event monitoring in production.
  • A documented incident management process, with customer notification without undue delay and in any event within 48 hours of becoming aware of a breach affecting your data, as committed in our DPA.

Reporting a vulnerability

If you believe you have found a security vulnerability in ISOvault, email security.isovault@agentmail.to. We will acknowledge within one UK business day, keep you informed while we investigate, and credit you if you would like us to. We ask that you do not access other customers' data or disrupt the service while investigating, and that you give us reasonable time to fix the issue before public disclosure.

Security questionnaires

Need this in your own format? Email hello.isovault@agentmail.to and we will complete your supplier security questionnaire.