MissionDuty
Start free trial

Trust centre

How MissionDuty protects your data, what’s in place today, and where we are on independent certification.

Where we are on certification

We don’t hold any security certifications yet. We’ve committed to independent certification for Cyber Essentials Plus and ISO/IEC 27001 by September 2027, and ISO/IEC 27701 where we can. Until then this page sets out exactly what’s in place and what isn’t. We’ll add each scheme’s official mark here once its certificate is issued, and not before.

Standards and frameworks

Cyber Essentials and Cyber Essentials Plus

In progress

The UK government-backed scheme, run by the NCSC with IASME, covering five technical controls. Plus adds an independent hands-on audit.

Working towards certification, target September 2027

In place
  • User access control: every sign-in needs a second factor or Microsoft sign-in; permissions are set per role
  • Secure configuration: security headers, input validation and rate limiting on sign-in
  • Public traffic is served over HTTPS only, and the database connection requires TLS
Still to do
  • Bring our own laptops, phones, network and cloud accounts into scope and check them against the five controls
  • Cyber Essentials self-assessment, then the Cyber Essentials Plus audit

ISO/IEC 27001:2022

In progress

The international standard for an information security management system, certified by an accredited body after an independent audit.

Working towards certification, target September 2027

In place
  • A written inventory of every use of cryptography, with owners and dates
  • A written and tested backup and restore procedure
  • Audit logging of changes, and a list of the suppliers who process customer data
Still to do
  • Define the management system's scope, risk assessment and Statement of Applicability
  • Policies, staff training and an internal audit
  • Certification audit by a UKAS-accredited certification body

ISO/IEC 27701

Planned

The privacy extension to ISO/IEC 27001, for managing personal data.

Planned, building on ISO/IEC 27001

In place
  • The data protection measures listed under UK GDPR below
Still to do
  • Extend the ISO/IEC 27001 management system to cover privacy, then certify alongside it where possible

UK GDPR and the Data Protection Act 2018

In progress

The law on personal data in the UK. There is no official certificate for it; this is how we handle data under it.

Measures in place; policies in legal review

In place
  • The web app, API, database, files and backups are hosted in London
  • A data processing agreement for customers and a published list of sub-processors
  • A tool for administrators to delete a person's data on request
  • Only essential cookies unless a visitor chooses otherwise
  • The AI fleet admin sends only what it needs: medical records, for example, go no further than their type and expiry date
Still to do
  • Complete the legal review of our privacy policy and data processing agreement
  • Registration with the ICO

NCSC Cloud Security Principles

Planned

The NCSC's 14 principles for evaluating a cloud service. They're a framework for self-assessment, not a certificate.

Self-assessment planned, alongside ISO/IEC 27001

In place
  • Most of the technical measures listed on this page map to these principles
Still to do
  • Publish a principle-by-principle self-assessment for customers

NCSC Cyber Assessment Framework (CAF)

Planned

How operators of critical national infrastructure are assessed, including the security of their suppliers.

Evidence pack for customers planned

In place
  • The documents listed under Documents on request
Still to do
  • An evidence pack that maps MissionDuty to the CAF's supply-chain outcomes, for customers who are assessed against it

NCSC post-quantum cryptography migration

In progress

The NCSC's timeline for moving to cryptography that quantum computers can't break: plan by 2028, priority systems by 2031, complete by 2035.

Plan in place, ahead of the 2028 milestone

In place
  • An inventory of every use of cryptography and a migration plan
  • Connections from MissionDuty to other services offer hybrid post-quantum key exchange (X25519 with ML-KEM-768)
  • Encryption keys for stored secrets can be rotated
Still to do
  • Post-quantum connections from browsers and to the database, as our hosting providers add support
  • Post-quantum certificates and passkeys, as the industry makes them available

Independent penetration testing

Planned

Testing by an accredited third party that tries to break in the way an attacker would.

Planned

In place
  • Automated tests of sign-in, permissions and data separation between customers run on every change
Still to do
  • A test by a CREST-accredited tester, with a summary available to customers

What’s in place today

Signing in

  • Each organisation's administrators choose how its people sign in: passkeys (the default), a password with an authenticator app, Microsoft Entra ID, or a mix. A password on its own never opens an account.
  • Passkeys live on the person's phone, laptop or security key and are confirmed with their fingerprint, face or device PIN. They can't be phished or reused on another site, so we recommend them.
  • Authenticator app codes are accepted once each. Organisations using Microsoft Entra ID sign in under their own Entra policies; Microsoft sessions last at most 12 hours before signing in again, and disabling someone in MissionDuty ends any session they have open.
  • Changing the sign-in methods ends sessions that used a method no longer allowed. Changes, new passkeys and authenticator apps, and backup code use are recorded in the audit log.

Protecting data

  • Connections use TLS, with hybrid post-quantum key exchange where the other end supports it.
  • Credentials we hold for you, such as integration keys and sign-in secrets, are encrypted with AES-256-GCM, with keys that can be rotated. Passwords are hashed with bcrypt.
  • Passkeys are stored as public keys only. The private key never leaves the person's device.
  • The database is hosted in London by our hosting provider, which encrypts stored data.
  • Every uploaded file is encrypted by MissionDuty with its own key before it's stored, on top of the provider's own encryption.

Keeping customers separate

  • Every request is limited to the customer's own data, and automated tests check that one customer can't see another's.
  • Permissions are set per role, and actions that need a permission check it every time.
  • MissionDuty staff can only view your data if you switch on support access. It's read-only, time-limited and needs a recorded reason.

Visibility and recovery

  • Changes are recorded in an audit log, which you can send to your own security monitoring (SIEM).
  • Backups are kept for 35 days in your data's region. Nightly backups are encrypted to a key held offline, not on our servers, and stored separately from the live system. Deleted data is gone from them within 35 days.
  • We test restoring a backup every month. Our targets for a serious incident: lose no more than 24 hours of data (normally only minutes, for anything in the last 7 days), and be working again within 4 hours.

Who processes your data

The suppliers who process customer data, and what each does, are listed in our privacy policy and data processing agreement.

Documents on request

For customers and those evaluating MissionDuty, under a confidentiality agreement where needed:

  • Data processing agreement
  • Sub-processor list
  • Cryptography inventory and post-quantum migration plan
  • Backup and restore procedure
  • Answers to security questionnaires

Ask us at [email protected].

Report a security issue

If you think you’ve found a security problem in MissionDuty, email [email protected] with what you found and how to reproduce it. Please don’t access or change other people’s data, and give us a chance to fix the problem before telling anyone else. We’ll acknowledge your report and keep you updated. Our security.txt has the same details.