Trust centre
Security, privacy and compliance, in one place.
Cyber Essentials certifiedThe UK government-backed security standard. Issued 8 October 2026 by IASME. Verify our certificate
Everything your team needs to approve us as a supplier. If you can’t find an answer here, ask and we’ll give you a straight one.
- ICO registered
- ZB780862
- Multi-factor authentication
- On every system that supports it
- Encryption
- In transit and at rest, on every platform
- Breach notification
- Within 24 hours
- Cyber Essentials
- Certified, October 2026
- Client data
- Separate account per client
Documents. Policies, terms and statements.
Everything is online. Confidential policies sit in our document vault: request access once and a director approves it, usually the same working day.
Legal and contracts
- Cookie PolicyThe cookies and similar technologies on our website, the Lead Ignition CRM and our client portal, and how to change your choice. Read online
- Data Processing AgreementOur standard UK GDPR Article 28 terms for every client, with technical measures and sub-processors. Read online
- Privacy NoticeHow Lead Ignition collects and uses personal data as a controller, and your rights. Read online
- SaaS Terms and ConditionsThe terms that apply to the Lead Ignition CRM and related services. Read online
- Sub-processor listEvery provider that processes client data Read online
Security and data protection
- Business Continuity and Disaster Recovery PlanRecovery targets, backups, scenarios and testing. Vault, on request
- Change Management and Secure Development StandardHow changes to code, apps and client systems are made safely. Vault, on request
- Data Protection Policy and Breach ProcedureHow we meet UK GDPR as a processor and controller, and how we handle a personal data breach. Vault, on request
- Device and Acceptable Use StandardThe rules for every device and person that touches client data. Vault, on request
- Information Security PolicyAccess control, encryption, devices, patching, monitoring and incident handling. Vault, on request
- Leaver and Access Termination ProcedureRemoving access when someone leaves, and the annual access review. Vault, on request
- People and Conduct PoliciesWhistleblowing, equal opportunities, modern slavery, anti-bribery and financial crime. Vault, on request
- Risk Management PolicyHow we identify, assess, treat and review risk. Vault, on request
- Data Retention and Deletion ScheduleHow long we keep each type of data, and how it is deleted. Vault, on request
- International Transfer Risk AssessmentOur assessment of transfers of personal data outside the UK. Vault, on request
- Sub-processor RegisterEvery sub-processor, its role, location, safeguards and due diligence. Vault, on request
- Supplier and Sub-processor Due Diligence ProcedureHow we vet a supplier before it touches client data. Vault, on request
People and responsibility
- Code of Business StandardsHow we do business: integrity, fair payment, conflicts, health and safety, and speaking up. Read online
- Complaints ProcedureHow to raise a complaint and what we will do. Read online
- Environmental PolicyOur environmental impact and commitments as a small, remote business. Read online
- Modern Slavery and Human Trafficking StatementOur voluntary statement on preventing modern slavery in our business and supply chain. Read online
Security controls. What we actually do.
We’re a small team working remotely on certified cloud platforms. We keep access tight and our devices secure, and where we don’t run a control, we say so.
Access control
- Least-privilege access: people get the narrowest role that lets them do the work.
- Multi-factor authentication on every business system that supports it.
- Named accounts only. No shared logins. Credentials held in a password manager.
- Each client is set up in its own separate account. Data is never shared between clients.
- Platform support access to your account is off by default and only enabled with your written permission.
- Access reviewed at least annually, and removed the same day someone leaves or a project ends.
Data protection and encryption
- Data encrypted in transit (TLS) on every platform we use.
- Data encrypted at rest with AES-256 in the CRM, in app databases and on app hosting. Google Workspace encrypts stored email and documents too.
- Full-disk encryption on every device used for client work.
- Client personal data is worked on in the platform, not stored on laptops.
- We act as a data processor and only act on your documented instructions.
Devices
- Everyone with access signs our Device and Acceptable Use Standard.
- Automatic screen lock, automatic operating system and app updates.
- Reputable anti-malware installed and kept current.
- Lost or stolen devices are reported straight away and access is revoked.
Secure development
- All code in version control. Changes reviewed before going live.
- Every change checked on a preview environment before production.
- Production, preview and development environments kept separate.
- Database row-level security so users only reach their own records.
- Automated dependency scanning. Critical issues fixed within 14 days.
- API keys and secrets never stored in code.
Incidents and continuity
- A written data breach procedure, followed for every suspected incident.
- Clients told without undue delay, and within 24 hours of us becoming aware.
- A retained 24/7 cyber incident response service.
- A business continuity plan covering platform outages, lost devices, cyber attack and loss of a key person.
Suppliers
- Every sub-processor is listed publicly, with links to its own data processing terms.
- Each provider is bound by data processing terms that meet UK GDPR.
- The sub-processor register is reviewed every six months and whenever a provider changes.
- Clients are given notice of new sub-processors before they are used.
People
- Everyone with access to client data signs a confidentiality agreement.
- One named person is accountable for security and data protection: Alex Moyies, Director.
- Clear routes to raise concerns, including a whistleblowing policy.
Artificial intelligence
- We tell you which AI services, if any, will touch your data before we use them.
- AI features in your system are only switched on with your agreement.
- AI outputs that affect your customers are reviewed and tested before going live.
Your data. Who holds it and why.
You are the data controller. We are your processor: we only handle your data to deliver the work you asked for, on your documented instructions, and it stays yours.
- CRM records
- Held by our CRM platform provider in the United States, in your own separate account.
- App and portal databases
- Hosted in London or Ireland, with row-level security.
- Email and documents
- Google Workspace, protected with multi-factor authentication.
- On our laptops
- Nothing, where it can be avoided. Devices are encrypted regardless.
- International transfers
- Covered by each provider's data processing terms and UK GDPR transfer safeguards.
- When we finish
- Your data is returned or exported, then our access is removed and copies deleted.
Sub-processors. Every provider that touches client data.
Each provider is bound by its own data processing terms, linked below with its own list of sub-processors. We give clients notice before adding a new one. Last reviewed 11 October 2026.
| Provider | What it does for clients | Where data is processed | Their terms |
|---|---|---|---|
| HighLevel, Inc. | The CRM platform behind Lead Ignition: records, emails, messages, calls | United States (Google Cloud and AWS) | Data processing termsTheir sub-processors |
| Supabase, Inc. | Databases for client apps and portals | London and Ireland | Data processing termsTheir sub-processors |
| Vercel, Inc. | Hosting and running client apps and portals | London region for UK client apps, global edge network | Data processing termsTheir sub-processors |
| Google LLC (Google Workspace) | Our email and documents, where client information is shared for support | United States and Europe | Data processing termsTheir sub-processors |
| Anthropic, PBC | AI behind Sparky and our client portal, and our team's AI assistant for build and support work | United States | Data processing termsTheir sub-processors |
| GitHub, Inc. | Source code for the apps and portals we build | United States | Data processing termsTheir sub-processors |
| Virtual Admin Assistance (VAA UK) | Virtual assistant support: our email inbox and calendar | United Kingdom | Written processing terms with us |
Due diligence questions.
The questions supplier assessments ask us most, answered plainly. Got a questionnaire? Send it over.
Send us your questionnaireAre you Cyber Essentials certified?+
Yes. Lead Ignition is certified to Cyber Essentials, the UK government-backed scheme that checks the core technical controls: firewalls, secure configuration, user access, malware protection and security updates. The certificate covers the whole organisation, was issued by IASME on 8 October 2026 and is renewed every year. You can verify our certificate on the public register. We are not certified to ISO 27001; our platform providers’ certifications are set out under penetration testing below.
Where is our data stored?+
CRM data is held by our CRM platform provider in the United States. Databases for custom apps and portals are hosted in London or Ireland. Transfers outside the UK are covered by each provider's data processing terms, including the international transfer safeguards UK GDPR requires.
Is our data kept separate from other clients?+
Yes. Every client has its own separate account on the platform. Nothing is shared between accounts.
Who at Lead Ignition can access our data?+
Only the people working on your account, with the narrowest access that lets them do the job, and only while they need it. Everyone with access signs a confidentiality agreement and our device standard.
What happens if there is a data breach?+
We follow our written breach procedure: contain it, record it, assess the risk, and tell you without undue delay and within 24 hours of becoming aware, so you can meet your own reporting obligations.
How is our data backed up?+
Our platforms back up data in line with their published backup policies. Our business continuity plan sets out what we do if a platform, a device or an account becomes unavailable.
Do you use AI with our data?+
Some of our builds use AI, for example to read enquiries or summarise records. We tell you which services are involved before we use them, and AI features are only switched on with your agreement.
Do you carry out penetration testing?+
We don’t run our own servers or network, so testing happens where your data actually lives: with our sub-processors. From their published security pages (checked 5 October 2026):HighLevel (CRM platform): regular third-party penetration testing, automated vulnerability scanning, a responsible disclosure programme and annual SOC 2 Type II assessments.Supabase (app databases): regular penetration tests with industry experts and automated code scanning. SOC 2 Type 2 and ISO 27001 certified.Vercel (app hosting): annual third-party penetration tests plus targeted assessments, and a public bug bounty programme. SOC 2 Type 2 and ISO 27001 certified.Google Workspace (email and documents): a public vulnerability reward programme and independent certification against international ISO/IEC security standards.Code we write ourselves is scanned automatically for vulnerable dependencies and reviewed before release.
Will you sign our data processing agreement?+
No. We have a standard data processing agreement that covers every client and meets UK GDPR Article 28. See our data processing agreement.
Will you complete our supplier questionnaire?+
Yes. Send it over and we will come back to you. Most questions are already answered on this page.
What happens to our data when we stop working together?+
Your data is yours. We return or export it in a usable format, then remove our access and delete what we hold, in line with our leaver and access termination procedure.
Company details.
- Legal name
- Lead Ignition Ltd
- Registered in
- England and Wales
- Company number
- 15542026
- Registered office
- 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
- ICO registration
- ZB780862
- Cyber Essentials
- Certified by IASME, 8 October 2026. Certificate f48994ee-186b-46ee-b5a0-332a963fb80c. Renewed annually
- Accountable for security and data protection
- Alex Moyies, Director
- Security contact
- [email protected]
- Data protection contact
- [email protected]
Spotted a security issue?
Email [email protected]. Both directors receive it, we acknowledge within 2 business days, and we keep you updated until it is resolved.
Looking for something else? Get in touch.