Security

Our customers trust us with workforce data, including identity documents, pay information and location records. This page explains how we protect it.

Where your data is held

The Vyce platform runs on Amazon Web Services in the United Kingdom. Customer data stays in the UK. We do not host customer data outside the UK.

Encryption

Data is encrypted in transit using TLS 1.2 or above, and encrypted at rest.

Access control

Access to production systems is limited to the people who need it for their role, and protected by multi-factor authentication. Access is removed immediately when someone leaves.

Within the platform, Vyce supports role-based permissions, so you can control what each person in your organisation can see and do.

Backups

We take regular automated backups and hold them in the UK.

Testing and development

Changes are reviewed before release. We test our platform continuously as part of development, including security testing. We have not yet commissioned an external penetration test.

Our security standard

We align our controls with the Cyber Essentials scheme and are working towards certification. We are not currently certified.

Personal data breaches

If a breach affects your data, we'll tell you without undue delay and, where required, within 72 hours of becoming aware. We'll tell you what happened, what data was involved, what we're doing about it, and what we recommend you do.

Reporting a security issue

Email security@vyce.io, or see our Vulnerability Disclosure Policy.