Compliance programme

Policy documents

• Information security policy

  The top-level policy: what Depozza protects, who is accountable, and the rules everyone working on the platform follows.

  SOC 2 CC1–CC2 · ISO 27001 cl. 5, A.5.1
• Access control policy

  How identities, permissions and least privilege are enforced — in the product, in the database and for administrators.

  SOC 2 CC6 · ISO 27001 A.5.15–A.5.18, A.8.2
• Data retention and deletion

  What Depozza keeps, for how long, and how you exercise your access, portability and erasure rights.

  GDPR art. 5(1)(e), 15, 17, 20 · ISO 27001 A.5.33–A.5.34
• Incident response and breach notification

  How Depozza detects, classifies, contains and communicates security incidents — including the 72-hour regulator deadline.

  SOC 2 CC7 · ISO 27001 A.5.24–A.5.28 · GDPR art. 33–34
• Change management and secure development

  How changes reach production safely: review, automated checks, versioned database migrations and the ability to roll back.

  SOC 2 CC8 · ISO 27001 A.8.25–A.8.32
• Backups, availability and continuity

  How Depozza keeps the service available and how data is restored if something is lost.

  SOC 2 A1 · ISO 27001 A.5.29–A.5.30, A.8.13
• Risk and asset management

  How Depozza identifies what matters, what could go wrong, and what is being done about it.

  SOC 2 CC3 · ISO 27001 cl. 6, A.5.7, A.5.9
• Subprocessors and supplier management

  The third parties that process personal data on Depozza's behalf, what they do, and where the data sits.

  GDPR art. 28, 44–49 · ISO 27001 A.5.19–A.5.22
• Record of processing activities

  The GDPR Article 30 register: what personal data Depozza processes, why, on what legal basis, who receives it and how long it is kept.

  GDPR Art. 30 · ISO 27001 A.5.34 · SOC 2 P1
• Data protection impact assessment

  Screening of the higher-risk processing on Depozza — identity verification, payments and dispute evidence — with the risks identified and the measures that reduce them.

  GDPR Art. 35 · ISO 27001 A.5.34
• Operational reviews and evidence calendar

  The recurring checks an auditor asks for — access reviews, backup restore tests, log reviews and policy approval — with who runs them and how the evidence is kept.

  SOC 2 CC4.1 · ISO 27001 A.5.35, A.8.13

Control overview

Mapped to SOC 2 Trust Services Criteria, ISO/IEC 27001:2022 Annex A and the GDPR.

• Row-level security on every table, plus column-level revokes on sensitive fields

  CC6 · A.5.15

  In place

• Multi-factor authentication and leaked-password checking on accounts

  CC6.1

  In place

• Append-only audit log of administrative and sensitive actions

  CC7.2 · A.8.15

  In place

• Versioned database migrations and automated checks before release

  CC8.1

  In place

• Encrypted automated backups with point-in-time recovery, stored in the EU

  A1.2 · A.8.13

  In place

• Self-service data export and account deletion in Settings

  GDPR 15/17/20

  In place

• Documented incident response with 72-hour regulator notification

  GDPR 33 · CC7.4

  In place

• Published subprocessor list with EU hosting or standard contractual clauses

  A.5.19

  In place

• Record of processing activities (RoPA) covering every category of personal data

  GDPR 30 · A.5.34

  In place

• Data protection impact screening documented for identity checks and payments

  GDPR 35

  In place

• Automated retention job deleting support tickets after 3 years and logs after 12 months, with dated run records

  GDPR 5(1)(e) · A.5.33

  In place

• Quarterly administrator access review, evidenced with dated records on the evidence page

  CC4.1 · A.5.35

  In place

• Annual backup restore test evidenced with a dated record

  A1.2 · A.8.13

  Planned

• Independent external penetration test

  CC4.1

  Planned

• Third-party audit and certification (not yet started)

  SOC 2 / ISO 27001

  Planned