ESG - GOVERNANCE
Governance
Strong governance is at the heart of our everyday business. It's built into our client contracts and SLAs, so our clients know that we mean what we say.
Security
Our “no technical jargon” promise has never been more relevant than in the area of security. It’s easy to make broad and misleading statements here. Instead, we focus on actions that make a real difference to our customers, and we never stop trying to improve our approach.
Information security policies
As an IT company we advise our clients on IT security every day, so it’s no surprise that we take our own internal IT security very seriously. That means secure access for our team’s devices and our back-of-house systems, two-factor authentication, secure passwords and other good-sense practices.
Certification
Cyber Essentials: we are Cyber Essentials certified by the UK Government (IASME-CE-044041), which means we have met set criteria to protect our systems from cyber threats and remain committed to doing so.
ISO 27001: our approach is to focus on putting in place the processes and systems that make a real difference while we work towards certification. For example, we invest significantly in security training across the team, especially for our developers, who receive regular external expert training on new threats, methods of attack and how to prevent them.
Product security policies
Our products are essential to the everyday running of our customers’ businesses, and they hold customer data. The key to keeping them secure is regular testing. We carry out penetration (anti-hacking) testing every quarter across our key products, twiindata, twiinvoice and twiinworkspace, and testing is built into the development and trialling of every new service or software upgrade.
Security matters most for twiindata, our data bandwidth management service, and we approach it in two ways. Penetration testing focuses on the cloud software, making sure the system cannot be reached externally. The physical network is unique to each customer, but our ability to automatically load firmware patches, together with a constant audit approach to updates, helps keep each site secure.
Fundamentally, though, network security also comes down to how the network is physically deployed and managed on site. Think of it like buying a brand-new car with the best possible anti-theft system, then leaving the keys in the ignition: if a comms cabinet door is left open, or a wireless access point is deployed incorrectly, network security is compromised.
GDPR
Our data privacy policy is GDPR-compliant and you can read it here. It is supported by internal systems and policies that protect our clients’ data and are embedded in the way we do business every day.
For our internal systems we are the data owner; for our products we are the data processor.
Financial audit
As part of the wider CP Holdings Group, we are held to their high standards of financial process, reporting and audit.
Explore our ESG commitments
See how we're reducing our environmental impact, and how we look after our people and communities.