Resources
Public documents open directly. Security policies are confidential and shared on request.
Legal and privacy
- View
Data Processing Agreement
Our GDPR Article 28 terms, with the EU SCCs, the UK Addendum and our security measures. Applies to every subscription.
- View
Sub-processor list
Every provider that processes personal data for us, what it does and where.
- View
Privacy Policy
How we handle the personal data we control: website, account and billing.
- View
Terms of Service
The agreement that governs GainTrace, including security (§8) and data on exit (§11).
- View
security.txt
Machine-readable contact for reporting vulnerabilities (RFC 9116).
Governance
ISMS ManualDocument · GT-DOC-01
How our information security management system is run, reviewed and improved.
ISMS Scope DocumentDocument · GT-DOC-02
The people, systems, locations and services the security program covers.
ISMS Information Security Roles & ResponsibilitiesDocument · GT-DOC-03
Who owns which security duty, and how duties are separated in a small team.
System DescriptionDocument · GT-DOC-04
The GainTrace service, its infrastructure, software, data flows and boundaries.
SOC 2 Control MatrixDocument · GT-DOC-06
Every Trust Services Criterion mapped to our policies, controls and evidence.
Information Security PolicyPolicy · GT-POL-01
Our top-level security commitments and the policies that sit beneath them.
Organization of Information Security PolicyPolicy · GT-POL-02
Security governance, segregation of duties and management oversight.
Risk Assessment & Management PolicyPolicy · GT-POL-23
How we identify, score, treat and track security, privacy and fraud risk.
Compliance PolicyPolicy · GT-POL-24
Tracking legal, regulatory and contractual obligations, including GDPR.
Compliance ProcedureProcedure · GT-PRO-11
The yearly compliance calendar, control testing and remediation steps.
AI Governance PolicyPolicy · GT-POL-25
How AI features use customer data: tenant-bound models, no provider training.
Access and assets
Access Control PolicyPolicy · GT-POL-03
Least privilege, MFA, SSO, role-based access and access reviews.
Access Control ProcedureProcedure · GT-PRO-01
Joiner, mover and leaver steps, approvals and quarterly reviews.
Asset Management PolicyPolicy · GT-POL-04
Inventory and ownership of devices, systems, accounts and data stores.
Asset Management ProcedureProcedure · GT-PRO-02
Registering, issuing, checking and retiring company assets.
Acceptable Usage PolicyPolicy · GT-POL-05
Rules for using company devices, accounts, data and AI tools.
Endpoint Security PolicyPolicy · GT-POL-06
MacBook-only fleet with FileVault, auto-lock, firewall and automatic updates.
Physical & Environmental Security PolicyPolicy · GT-POL-22
Workspace, device and data-centre physical protections.
Physical and Environmental Security ProcedureProcedure · GT-PRO-10
Day-to-day physical security steps for offices and remote work.
Data and privacy
Data Classification PolicyPolicy · GT-POL-07
Four data classes and the handling rules for each.
Data Protection PolicyPolicy · GT-POL-08
GDPR principles, lawful processing, data subject rights and transfers.
Data Retention PolicyPolicy · GT-POL-09
How long each kind of data is kept, and how it is deleted.
Media Disposal PolicyPolicy · GT-POL-10
Secure wiping and disposal of devices and storage media.
Encryption PolicyPolicy · GT-POL-11
TLS 1.2+ in transit, AES-256 at rest, and key management.
Privacy By Design PolicyPolicy · GT-POL-12
Privacy reviews, data minimisation and DPIAs for new features.
Operations and engineering
Communications & Network Security PolicyPolicy · GT-POL-13
Network segmentation, edge protection and secure data transfer.
Network Security ProcedureProcedure · GT-PRO-03
Firewall rules, change control and periodic network review.
Operation Security PolicyPolicy · GT-POL-14
Logging, monitoring, vulnerability and patch management, capacity.
Operations Security ProcedureProcedure · GT-PRO-04
Patch timelines, alert handling and production change steps.
System Acquisition and Development Lifecycle PolicyPolicy · GT-POL-15
Secure design, code review, testing and release requirements.
SDLC ProcedureProcedure · GT-PRO-05
From ticket to production: review, CI checks, deploy and rollback.
Resilience and incidents
Incident Management PolicyPolicy · GT-POL-16
Severity levels, roles and duties when something goes wrong.
Incident Management ProcedureProcedure · GT-PRO-06
Detect, triage, contain, recover and learn, step by step.
Data Breach Notification PolicyPolicy · GT-POL-17
Who we notify about a breach, and how fast.
Personal Data Breach Notification ProcedureProcedure · GT-PRO-07
The GDPR Article 33 and 34 workflow, with templates.
Business Continuity & Disaster Recovery PolicyPolicy · GT-POL-18
Recovery objectives, backups and restore testing.
Business Continuity PlanPlan · GT-DOC-05
Scenarios, recovery steps and contacts if a key system fails.
People
HR Security PolicyPolicy · GT-POL-19
Screening, confidentiality, security training and offboarding.
HR Security ProcedureProcedure · GT-PRO-08
Onboarding and offboarding checklists, training records.
Code of Business Conduct PolicyPolicy · GT-POL-20
Integrity, confidentiality, conflicts of interest and reporting concerns.
Third parties
Vendor Management PolicyPolicy · GT-POL-21
Risk-based review of every vendor and sub-processor.
Vendor Management ProcedureProcedure · GT-PRO-09
Due diligence, contract terms and yearly re-review steps.