Security dossier / For IT review
The posture, stated plainly.
What follows is the position an IT director should expect to verify during procurement. No marketing language; each line is a commitment.
01Identity
Your tenant is the front door.
SIGN-ONSingle sign-on through Microsoft Entra ID. The institution's own tenant enforces access.
LEAVERSAccounts deactivate with the institution's own leaver process. No orphaned access.
MFAMulti-factor authentication inherited from the institution's own policy.
02Data protection
Your data. Our processing. In writing.
FRAMEWORKUK GDPR alignment throughout.
ROLESThe institution is Data Controller and owner of its data. Vyte is Data Processor.
AGREEMENTA Data Processing Agreement per client, as standard.
RIGHTSData-subject rights supported, including access, export and deletion.
03Residency and encryption
Kept encrypted. Kept in writing.
RESIDENCYClient data hosted in the EU (Ireland), under UK GDPR.
IN TRANSITTLS for all traffic.
AT RESTAES-256 encryption at rest.
FIELD LEVELField-level encryption for the most sensitive records.
04Assurance
Tested by people paid to break it.
TESTINGIndependent penetration testing, annually.
CERTIFICATIONCyber Essentials pathway.
AUDITAudit logging of sensitive operations.
Philosophy
Security is evaluated before a feature is built. Never after.
Request the full documentation →