Privacy policy

ISMS Workspace is operated by the organisation that runs this workspace. That organisation is the controller of the information stored in it. Questions about this policy should be sent to the workspace administrator who invited you.

We collect only what the workspace needs to work:

• Account data — your name, email address and authentication details, including the enrolment record for your multi-factor authenticator.
• Workspace content — the controls, risks, policies, audits, review dates and evidence documents you and your colleagues create or upload.
• Activity data — an append-only audit log of changes to assessments, risks, policies and evidence, recording who made the change and when.
• Security data — hashed records of password reset requests used to limit abuse.

To give you access to the workspace, to keep an accurate record of information security management activity, to protect accounts against unauthorised access and abuse, and to provide the exports and reports you request.

Account data and workspace content are held in a managed database, and uploaded documents are held in private storage that is only reachable through short-lived, signed links issued to signed-in users. Access is restricted by role.

We do not sell personal data. Data is shared only with the infrastructure providers needed to host the workspace and deliver its emails, and where the law requires it. Evidence you export or share with an auditor leaves the workspace under your control.

Workspace content is kept for as long as your organisation needs it as compliance evidence. Audit-log entries are append-only and cannot be edited or deleted from the application. Account records are removed when an administrator removes the account.

Depending on where you live, you may have the right to access, correct, export or erase your personal data, or to object to certain processing. Contact your workspace administrator to exercise those rights; requests that affect compliance records may be subject to your organisation's retention obligations.

If this policy changes we will update the date at the top of this page and, for material changes, notify workspace administrators.