Walters Sentinel
What we say about security, and how to check it yourself.
Your security team should not have to take our word for it. Below are our entries on the public registers, live tests of our own sites, and the documents a supplier review asks for, ready to read or download.
Checked by somebody other than us.
Each link opens the register or the test itself, not a copy of it.
Data protection
Registered with the Information Commissioner's Office, reference ZC277121.
Look us up on the ICO register
The company
APW Consulting Ltd, trading as Walters Sentinel, registered in England and Wales, company 06087068. VAT GB902021393. D-U-N-S 219014037.
See the company at Companies House
Encryption in transit
Qualys SSL Labs tests how our sign-in address encrypts connections, live, each time you ask.
Run the test
Security headers
Mozilla Observatory tests the security headers our pages send: HSTS, a Content Security Policy, and protection from being framed.
Run the test
How we are running
The platform's health, checked continuously, with its recent history.
See the status page
Reporting a problem
How to tell us about a security problem, and what happens next, with a security.txt for automated tools.
Our disclosure policy · security.txt
The documents a security review asks for.
Read them before we ever speak. Each is kept current, and dated.
Security overview
Where your data is held, how it is encrypted, how people sign in, how the service is built and changed, and what happens if something goes wrong.
Read the overviewBusiness continuity
Nightly encrypted backups, restored and checked every night, how we would recover, and what we aim for.
Read the summarySecurity questionnaire
49 common questions answered Yes, Partly or No, grouped by the Cloud Security Alliance's Cloud Controls Matrix (CCM v4) domains, so you can map them to your own.
Download the CSVData Processing Agreement
Part of our Terms. Breach notice within 48 hours, audit rights, and the Standard Contractual Clauses where data leaves the UK.
Read the agreementSub-processors
Every supplier that handles personal data for us, what it handles and where, with 30 days' notice before the list changes.
See the listPrivacy Policy
What we collect, why, how long we keep it, and your rights over it.
Read the policyHow your data is looked after.
Where it is
The application and its backups in London, the database in Ireland (EU), and email sent from London. On Enterprise, a dedicated deployment keeps everything in the UK, on a server nobody else uses.
Encryption
Personal details, free text, files and tokens are encrypted by the application with AES-256-GCM before they are stored, and every connection uses TLS. On Enterprise, your organisation can have a key of its own, or one held in your own AWS KMS or Azure Key Vault.
Signing in
Every password sign-in also needs a code we email, and passkeys are supported. Company sign-in through your own identity provider, automatic provisioning, roles you define, and an audit log chained by hash so any alteration shows.
Backups
The whole database, every night, encrypted, kept for 30 days apart from the database provider, and restored into a scratch database each night to prove it opens.
If something goes wrong
We tell you about a personal data breach affecting your data within 48 hours, and the ICO within 72 hours where the law requires.
Your data, your control
Admins export everything an organisation holds, and can delete an organisation themselves. We do not use your data to train AI models.
Said plainly.
We do not yet hold ISO 27001 certification or a SOC 2 report, and would rather tell you so than describe a plan as a certificate. In their place:
- We complete your own security questionnaire, in whatever format your process uses, at no charge.
- Enterprise organisations download a supplier pack: everything on this page as one zip, with your organisation on the data processing agreement's cover sheet.
- Enterprise Assured includes a security review call with us every year, and evidence for your auditors.
- Where your process needs one, we sign your NDA before a security call.
Reviewing us as a supplier?
Send your questionnaire, or tell us what your review needs. A real person replies, usually within one working day.