Certification-ready from day one.
Regulators and enterprise customers expect an ASP to prove its security. Our infrastructure is designed around the controls SOC 2 Type II and ISO 27001 auditors test, so a large part of your programme is in place before you start.
Controls you inherit, not rebuild.
Infrastructure-level controls are operated by us. You focus on the controls that belong to your organisation — and we give you the templates for those too.
Encryption everywhere
Documents and tax data are encrypted in transit and at rest, with managed key rotation.
Access control
Single sign-on, role-based access, least-privilege defaults and logged administrative actions.
Logging and monitoring
Centralised, tamper-evident logs with alerting on security and delivery events.
Change management
Reviewed, tested and traceable deployments, with a record of every change.
Resilience
Redundant infrastructure, backups and documented recovery procedures that are tested on a schedule.
Data residency
Regional deployments keep invoice and tax data in the jurisdiction your regulator requires.
Evidence over a full audit period.
A Type II report tests that controls operated effectively over months, not just that they exist. Continuous evidence collection is what makes that manageable.
- Control mapping to the Trust Services Criteria for security, availability and confidentiality
- Automatically collected evidence for infrastructure controls
- AI actions logged and explainable, so automation stays inside your audit scope
- Policy and procedure templates for the controls you own
- Support during auditor walkthroughs and evidence requests
An ISMS with a head start.
ISO 27001 certifies your information security management system. We supply the technical controls and documentation that slot into it.
- Annex A control mapping for the infrastructure we operate
- Risk register and asset inventory inputs for the e-invoicing service
- Statement of Applicability guidance
- Supplier documentation for your own vendor reviews
A note on certification
Certification is awarded to your organisation by an independent auditor or certification body. Our infrastructure and documentation make the process faster and more predictable; your own policies, people and processes are still part of the scope.
Planning an audit alongside your launch?
We will walk you through which controls you inherit and what is left for your team.