Security and governance
Designed for secure, governed work across your data, systems and workflows. Here is exactly how we protect them, and which certificates we do and do not hold.
Registered and compliant
Registered with the ICO and compliant with UK GDPR. We follow the Cyber Essentials framework, and the platforms we build on hold ISO 27001 and SOC 2. NYAS itself is not independently certified, and we say so plainly. Open any card to see what it means.
- UK GDPR compliant
- ICORegistered ZC200462
- Secure by designSecurity built into the foundation of everything we do
- ISO and SOC 2Held by our platforms, not by NYAS
-
UK GDPR compliant
We complyThe law on how anyone may handle information about people. We follow it, and we say so plainly.
What does this actually mean?
In plain EnglishUK GDPR is the law on handling information about people. Nobody awards it as a certificate. Complying means we only collect what we need, we tell people why, we keep it safe, and we delete it when we should.
How we meet it
- Registered with the ICOThe regulator’s public list, number ZC200462.
- Only what we need, kept for set periodsTranscripts 12 months, enquiries and logs 24 months, financial records 6 years.
- Written down before work startsThe audit, the proposal and the data protection schedule say what we build and what it processes.
- Email follows PECRCold email only to limited companies and LLPs, to a named person, with an opt out.
What it is notA legal duty we meet and a statement we stand behind. No outside auditor has checked it, and we will not pretend one has.
-
ICO registration
RegisteredNYAS Group Ltd is on the Information Commissioner’s public register.
What does this actually mean?
In plain EnglishIn the UK, a business that handles personal information has to register with the Information Commissioner’s Office. Being registered means NYAS is on the public list of organisations that are accountable for doing it properly.
How we meet it
- RegisteredNumber ZC200462, in the name of NYAS Group Ltd.
- Publicly checkableAnyone can search the register and find it.
What it is notProof that NYAS is a known, accountable data controller. It is not a security test, and it is not an audit.
-
Cyber Essentials
Secure by designThe UK government backed baseline against the most common attacks. We follow all five of its controls today. The independent certificate is the step we have not yet taken.
What does this actually mean?
In plain EnglishCyber Essentials is the UK government backed baseline for stopping the attacks that hit small firms most. It checks five basics. Certification means an assessor has passed your answers. We follow all five today, and we will not call NYAS certified until we hold the certificate.
How we meet it
- FirewallsThe firewall on our main work computer is on, with stealth mode.
- Secure configurationThe whole disk is encrypted, so a lost laptop is not a lost client.
- Security updatesAutomatic downloads and installs are switched on.
- User access controlEveryday work runs on a standard account, not an administrator, and the client portal needs two factor sign in.
- Malware protectionOnly checked, signed apps are allowed to run.
What it is notNot yet an independent certificate. We checked these on our main work computer on 7 October 2026. Certification covers every device, so that is what an assessor would test. It is the next step on our plan.
-
Cyber Essentials Plus
PlannedThe same five controls, tested by an outside assessor instead of answered on a form. This comes after Cyber Essentials.
What does this actually mean?
In plain EnglishCyber Essentials Plus covers the same five controls, but an assessor tests your devices hands on rather than trusting your answers. It is the badge larger organisations recognise and ask for.
How we meet it
- An assessor tests our devicesScans and checks run by someone independent.
- Passed before it is claimedWe will only show the badge once the certificate exists.
What it is notNot held and not claimed. It comes after Cyber Essentials.
-
ISO 27001
Built on certified platformsThe international standard for managing information security. Everything that stores and hosts your information is certified to it. NYAS itself is not yet independently audited.
What does this actually mean?
In plain EnglishISO 27001 is an international standard that audits how a whole organisation manages information security: written risk assessments, policies and yearly outside audits. A certificate means an independent body checked it. The platforms we build on hold it. NYAS does not yet, and the difference matters.
How we meet it
- Our database hostISO 27001 certified (Supabase).
- Our web hostISO 27001 certified (Vercel).
- Our email and documentsISO 27001 certified (Google Workspace).
What it is notThe certificates belong to those providers, not to NYAS. They show the ground we build on is independently audited. They do not make NYAS certified. We will pursue our own if a client requires it.
-
SOC 2
Built on certified platformsThe American standard for how a service protects customer data. Everything that stores and hosts your information is audited to it. NYAS itself is not yet independently audited.
What does this actually mean?
In plain EnglishSOC 2 is an American audit of how a service keeps customer information secure, available and confidential over a period of time. It is what many US buyers ask for. The platforms we build on hold it. NYAS does not yet.
How we meet it
- Our database hostSOC 2 Type 2 (Supabase).
- Our web hostSOC 2 Type 2 (Vercel).
- Our email and documentsSOC 2 and SOC 3 reports (Google Workspace).
What it is notTheir reports, not ours. We will pursue our own if a US enterprise client requires it.
How your information moves
Four steps, and a wall between clients that nothing crosses.
You share it
On a call, or through your own portal login with two factor sign in.
It goes into your own space
Kept apart from every other client by rules inside the database.
We check it
Nothing is sent, published or filed in your name until we have checked the exact version.
It goes out as approved
The version you saw is the version that leaves.
What we promise
Your information stays yours
Each client is separated by rules inside the database itself, not by anyone remembering to be careful, and we check the separation before every release. A new client's setup starts empty.
Passwords and keys are never loose
The client portal needs a second factor, so a stolen password alone is not enough. Passwords and keys live in a protected store, never in documents, chats or email.
A person holds the final call
Anything produced for you is a draft until it is approved. We prepare and prove. You, or your accountant, file. We never promise to file for you with HMRC or Companies House.
Records and retention
How long we keep what, so nothing sits around longer than it should.
Call and audit transcripts
Kept for 12 months, then deleted.
Enquiries, prospects and message logs
Kept for 24 months, then deleted.
Financial records
Kept for 6 years, as the law requires.
Security FAQs
The questions founders and their advisers ask before they share anything.
Are you Cyber Essentials certified?
Not yet. We follow the five Cyber Essentials controls, and the independent certificate is our next step. Until we hold it we will not describe NYAS as certified.
Are you ISO 27001 or SOC 2 certified?
Not yet. The platforms we build on hold both, and we show that clearly as theirs. NYAS itself holds neither, and we will pursue one if a client requires it.
Can another client see my information?
No. Each client is separated inside the database itself, and we check the separation before every release. A new client's setup starts empty.
Do you use my information to help other clients?
No. What we build for one client can be repeated for the next as instructions only, stripped of every detail that belongs to you.
How is access to my information controlled?
Portal sign in needs a second factor. Passwords and keys sit in a protected store and never in documents, chats or email, and any that is ever exposed is replaced.
Who can see my information?
Only the people working on your account, and the systems set up for it.
Will anything be sent in my name without me seeing it?
No. Nothing is sent, published or filed on your behalf until the exact version has been approved.
Where can I read what you build and process for me?
In the audit, the proposal, the terms and the data protection schedule, before any work starts.
How long do you keep my information?
Call and audit transcripts for 12 months. Enquiries, prospects and message logs for 24 months. Financial records for 6 years.
Can I send you our security questionnaire?
Yes. Send it before the first call or bring it with you, and we will answer it in writing.
Need to report a security issue?
If you believe you have found a vulnerability, or you have a security enquiry, email hayley@nyas.co.uk and we will answer it personally.