How is security managed?
Govform combines a certified information security management system with practical platform controls, security testing and clear operational processes.
Security covers both the technology and the way we work. Your team also has configurable controls for its own services, so access, file handling, retention and integrations can reflect the information being processed.
Several layers working together
| Security layer | What it contributes |
|---|---|
| Governance | An ISO/IEC 27001-certified management system, documented responsibilities, risk assessment and reviewed security policies. |
| People and processes | Security awareness training, access-management procedures and documented incident response arrangements. |
| Platform protection | Encrypted transport and storage, scoped authorisation and protected integration secrets. |
| Service controls | Configurable authentication, session timeouts, file protection, audience restrictions and retention. |
| Testing and change | Security testing, independent penetration testing and a controlled route through test and live environments. |
| Investigation | Application activity, audit records and incident handling processes to help identify and respond to problems. |
Give people the access their role needs
- Keep design and live data distinct. A designer or summary-analytics user can work on the service without access to individual Production responses.
- Limit test access. External QA testers can test services without being given Builder or analytics access.
- Protect connected access. API keys have endpoint permissions and optional source-IP restrictions; identity-provider connections support your organisation’s sign-in policies.
Explore controls and download certificates in the Security & Trust Centre, including certifications and access control.