Security, Privacy & Compliance
We take the security of your data seriously. Our platform is built with security and privacy at its foundation, not as an afterthought — and we would rather tell you plainly what we hold and what we do not than imply a certificate we cannot show you.
Certification and standards
Exyon Software holds Cyber Essentials certification. The certificate alongside is issued against the UK Government-backed Cyber Essentials scheme and can be verified in the issuing registry.
Our platform is built to align with ISO/IEC 27001 and Cyber Essentials Plus. Alignment means these frameworks were design constraints from the start — access control, encryption, logging, change management and supplier assurance were built to meet them rather than retrofitted. We operate an Information Security Management System on that basis.
We are not currently certified to ISO/IEC 27001 or Cyber Essentials Plus, and we do not hold a SOC 2 report. We will seek both certifications when it is commercially appropriate to do so. We would rather tell you that plainly than imply a certificate we cannot show you.
Our security documentation, control mapping and most recent recovery test report are available to clients and prospective clients under NDA on request.
Security at a Glance
Key security and compliance information for procurement and IT teams.
Certification held | Cyber Essentials |
Built to align with | ISO/IEC 27001, Cyber Essentials Plus |
Production hosting | United Kingdom |
Encryption at rest | AES-256 |
Encryption in transit | TLS 1.3 |
Backups | Daily, 30-day rolling retention |
Recovery targets | 4 hours to restore, 24 hours maximum data loss |
Our role under UK GDPR | Processor for client data |
How we protect your data
The controls behind the summary above, described in enough detail for your security team to assess them.
Hosting
Our production estate runs in the United Kingdom. Services are hosted on UK infrastructure today and are migrating to managed Kubernetes in Civo's London region; our public website already runs there. Databases and internal services are never exposed to the internet, and all public traffic is restricted at the network edge before it reaches us.
Encryption
TLS 1.3 in transit and AES-256 at rest. Particularly sensitive material — such as stored payroll provider credentials in HRoix — is encrypted with a dedicated key that rotates independently.
Identity and access
Authentication runs through ExyonID, our own OAuth 2.0 / OpenID Connect provider: Argon2 password hashing, account lockout, and multi-factor authentication by authenticator app or passkey, enforced for all staff and administrative accounts. Your own identity provider can be federated in (Entra ID, Google, Okta, OneLogin, SAML 2.0 or any OIDC provider).
No standing access to your data
No member of Exyon staff holds standing access to a customer tenant. Support access is requested, justified, approved, scoped to a single ticket, time-boxed, expires automatically and is fully audited.
Tenant isolation
Each customer's data is held in its own database schema. Cross-tenant leakage is treated as a release-blocking defect.
Backups and recovery
Daily backups with an encrypted copy held offsite with a separate provider, on a 30-day rolling retention. Our recovery targets are four hours to restore service and a maximum of 24 hours of data loss. Recovery is tested and the results recorded; our most recent full test passed across backup, restore, integrity, infrastructure rebuild, DNS and TLS.
Secure development
Source control, build and deployment are self-hosted and defined as code. Changes go through pull request and an automated pipeline; static analysis, dependency scanning, secret scanning and container image scanning run as build gates. Two of our products refuse to start if they are configured in a way that would bypass our AI controls.
Reporting a vulnerability
[email protected]. We acknowledge within two business days and target remediation of High and Critical issues within 14 days. Our full vulnerability disclosure policy, including our safe harbour commitment to researchers, is published at /security.
Where your data is processed
Your production data is hosted in the United Kingdom, and AI processing is pinned to a UK region by technical enforcement — our AI gateway refuses to start if configured against a non-UK provider region.
Some supporting services process limited data outside the UK: encrypted offsite backups are held with a European provider and are decryptable only on our own servers; transactional email is sent through an EU-based provider; payment and accounting providers operate globally; and our content delivery and DNS provider operates a global edge network. Every transfer is covered by the appropriate safeguard — adequacy, or the UK IDTA or Addendum to standard contractual clauses — and each provider is listed in our sub-processor register below.
- Production hosting and AI inference in the UK
- Processed under the UK GDPR and the Data Protection Act 2018
- Every onward transfer named, with its safeguard
Sub-processor register
The complete list of third parties that may process personal data on our clients' behalf. All sub-processors are contractually bound to protect your data, and we notify controllers before the list changes.
Version 1.0 · Updated 21 September 2026
| Sub-processor | Purpose | Products | Processing region |
|---|---|---|---|
| Civo | Managed Kubernetes, managed PostgreSQL, block and object storage | Target platform, estate-wide | LON1, London (UK) |
| Hostinger | Virtual private server hosting, daily snapshots | Current platform, estate-wide | United Kingdom |
| Hetzner | Encrypted offsite backup storageBackups are encrypted before transfer and are decryptable only on our own servers. | Estate backup | EU (offsite) |
| Cloudflare | DNS, edge delivery, TLS at the edge, origin firewall | All public services | Global edge network |
| Google Cloud (Vertex AI) | Large language model inference for AI featuresRegion is enforced technically: the AI gateway refuses to start against a non-UK provider region. | All AI features, via AI-Gateway only | europe-west2, London |
| AWS (Polly) | Text-to-speech narration | ExyonLearn | eu-west-2, London |
| Brixly (objspace.net) | S3-compatible object storage for media and documents | ExyonLearn, ExyonPulse, HRoix | United Kingdom |
| Brevo | Transactional email | ExyonID, ExyonLearn, ExyonPanel, ExyonSupport, HRoix, website | EU |
| Mailgun | Transactional email and inbound webhooks | ExyonPulse | Confirmation in progress |
| Stripe | Card payments and webhooks | ExyonPanel | Global |
| GoCardless | Direct debit | ExyonPanel | UK/EU |
| Xero | Accounting synchronisation | ExyonPanel | Global |
| Sentry | Error and performance monitoringBeing withdrawn from the estate. Disclosed here for as long as it remains in use. | ExyonID, ExyonLearn, ExyonPanel, ExyonSupport, HRoix | Confirmation in progress |
| Judge0 | Sandboxed execution of learner-submitted code | ExyonLearn (CodeLab) | Confirmation in progress |
| Zoom | Meeting webhooks | ExyonPulse | Global |
Not sub-processors, but disclosed for completeness
Public-sector and lookup services we integrate with on the customer's behalf:
- Companies House
- The Apprenticeship Service / ESFA / Skills England
- The Learning Records Service
- Address lookup
Self-hosted software, including source control and secrets management, is operated by Exyon and involves no third-party processing.
UK GDPR
No organisation can certify its own GDPR compliance, so we describe our obligations and how we meet them instead. Our contractual commitments are set out in full in our Data Processing Agreement.
Our Role
When providing services to educational institutions, Exyon acts as a Data Processor. The institution remains the Data Controller and determines the purposes and means of processing personal data.
For direct customers and website visitors, Exyon acts as the Data Controller.
Rights We Help You Fulfil
- Right to access your data
- Right to rectification
- Right to erasure
- Right to data portability
- Right to object to processing
Legal Documents
Access our legal and compliance documentation.
Security Questions?
If you have security or compliance questions, or need to report a security concern, please contact our team. Researchers should read our vulnerability disclosure policy first.