HomeSecurity and trust
Security and trust
Your data stays yours, and nobody's money is held.
Each person sees only what their role needs. The licensee controls its data. The platform never holds anyone's money.
Who controls the data
| Where | Data controller | Sceamdo's role |
|---|---|---|
| A licensee's CivicGrid | The licensee | Processor, only when Sceamdo hosts it on CivicGrid Cloud, under a data processing agreement |
| CivicGrid Sovereign | The licensee | None: Sceamdo supplies software and support, and does not hold the data |
| civicgrid.net and demo applications | Sceamdo Technologies Ltd | Controller |
Where data lives
- CivicGrid Sovereign: in the licensee's own country and cloud.
- CivicGrid Cloud: in the United Kingdom or the European Union, in a separate copy for each licensee.
Our commitments
- Personal data encrypted, and seen only by people whose role needs it.
- Every view of sensitive data recorded.
- Results published only in ways that cannot identify a person.
- Identity checks keep the result only, never card numbers or images.
- Independent penetration testing and accessibility audits before each launch.
The security pack
Verified institutions can request the security pack: our policies, our hosting providers' independent assurance reports, a data protection impact assessment template and, once completed, the penetration test summary.
To request it, email security@civicgrid.net from your work address after your demo access is approved.
Report a security issue
If you think you have found a security weakness in CivicGrid or civicgrid.net, email security@civicgrid.net. Please do not access other people's data or disrupt the service. We will acknowledge your report within 3 working days.
See CivicGrid working
The demo is open only to verified institutions. Apply with your work email and your institution's documents. A person at Sceamdo checks every application.