Security, compliance and the answers procurement asks
What we run, how we protect your data, and who else touches it.
Updated October 2026
Certifications and frameworks
- Cyber Essentials Plus-aligned controls; certification assessment booked.
- Microsoft partner (Cloud Solution Provider via Giacom).
- UK GDPR: controller and processor; Information Commissioner's Office (ICO) registration ZB852223.
We will show you our control mapping (NIST CSF 2.0, Cyber Essentials, UK GDPR) on request.
We are working towards the NHS Data Security and Protection Toolkit (DSPT), an evidence pack aligned with Financial Conduct Authority (FCA) expectations, and SOC 2 readiness.
What we run and where
- A private cloud we built and operate, running OpenStack and Kubernetes in a multi-datacentre deployment across London and Sofia, Bulgaria; Sofia is our disaster-recovery site.
- Our service desk (HaloPSA), infrastructure monitoring (Zabbix) and security monitoring (Wazuh) are self-hosted on that platform.
- Microsoft 365 and Microsoft Azure in UK or EU regions, when you choose them.
Based in London, with a disaster-recovery site and a second company in Sofia, Bulgaria. We work with clients in the UK, the United States, Switzerland, Germany, Norway, the United Arab Emirates, Australia and Lebanon.
Sub-processors
Other companies that process data as part of our service:
| Sub-processor | Purpose |
|---|---|
| Microsoft | Microsoft 365 and Azure, when you choose them |
| Cloudflare | Domain Name System (DNS), edge network and Turnstile bot protection |
| CyberDrain | Hosted CIPP (CyberDrain Improved Partner Portal), which we use to manage Microsoft 365 |
| Giacom | Microsoft licensing |
| Tailscale | Relay servers, used as an encrypted fallback for our virtual private network (VPN) mesh |
Encryption and secrets
- Transport Layer Security (TLS) 1.2 or later, with 1.3 preferred, and HTTP Strict Transport Security (HSTS) on vts64.com.
- Encrypted storage at our disaster-recovery site.
- Secrets held in OpenBao, a secrets manager we run ourselves.
- Key-only Secure Shell (SSH) access to our cloud and Kubernetes hosts.
- An internal certificate authority (step-ca) for our own services.
Identity and access
- Single sign-on (Authentik) for staff access to our internal tools.
- A tiered admin model that separates support, engineering and infrastructure access.
- Per-client access groups.
- Windows Local Administrator Password Solution (LAPS) on the Windows estates we manage.
Backup and disaster recovery
- Nightly logical backups: database dumps and application exports.
- Continuous replication from London to our disaster-recovery site in Sofia; an hourly recovery point is achievable.
- Tier-1 services were restored at the Sofia site in a rehearsal in September 2026.
- A complete, offline, encrypted archive of the platform is produced for an offsite tape cycle. It was restore-tested in August 2026.
We do not publish recovery-time figures until we have measured them for each service.
Monitoring and incident response
- Security information and event management (SIEM) with Wazuh, infrastructure monitoring with Zabbix, and alerts that open tickets in our service desk.
- Monitoring that watches the London platform from the disaster-recovery site, so an outage cannot silence its own alarm.
- Incidents are handled against the response targets in our standard agreement.
- If an incident touches your data, we tell you without undue delay, as the UK General Data Protection Regulation (UK GDPR) requires.
Live service status: service status page.
Vulnerability management
- Internal vulnerability scanning with Greenbone.
- An external penetration test of our public website in October 2026 found no vulnerabilities.
- Patch deadlines set by policy: workstations within 3 to 7 days, servers in a weekly maintenance window.
Documents under NDA
These documents are available under NDA on request:
- Data processing agreement.
- Information security management system (ISMS) scope statement.
- Information security policy.
- Disaster-recovery notes with the latest test evidence.
Email info@vts64.com to ask for them.
Security contact
Report a vulnerability or ask a security question at security@vts64.com. Our security.txt file gives the same contact. We reply within one UK working day.