Suppliers often show a row of badges. This guide explains what the common ones mean, so you can ask better questions than ‘are you compliant?’.
The four you will see most
GDPR: the data protection law that applies to personal data of people in the UK and the EU. It sets rules on how personal data is collected, used and kept.
SOC 2: a report in which an independent auditor checks a supplier’s security controls against a recognised standard.
ISO 27001: an international standard for how an organisation manages information security. A certification body audits against it.
HIPAA: a United States law about the privacy and security of health information. It matters if you handle US health data.
Why a badge is not the whole story
A badge tells you something was checked. It does not tell you what, or when. A report can cover one product and not another, and certificates expire.
Questions worth asking
Which of these do you hold today, and which are in progress?
What does it cover, and does it include the product I would use?
When was it last checked, and can I see the report or certificate?
If it is in progress, when do you expect it, and what is the next step?
Will you sign a Data Processing Agreement?
Warning signs. Logos with no detail. ‘Compliant with everything’. An answer that changes depending on who you ask. No supplier is compliant with everything.
Where we stand today
GDPR is in place. SOC 2, ISO 27001 and HIPAA are certifications in progress. We say so plainly, and we will tell you where we are in the process.
A Data Processing Agreement is available to every customer, and we share our security pack when you are in conversation with us. You can request it from our Trust Centre.
* SOC 2, ISO 27001 and HIPAA: certification in progress.
