Trust centre
Our terms, privacy documents and certifications for Reach, and how to request our detailed security documents.
Certifications and compliance
ISO/IEC 27001 (information security management)
Information security management, independently audited. Registered alongside ISO 9001 for quality management.
Certificate 375302021
Cyber Essentials Plus
The UK government-backed scheme for protection against the most common cyber attacks, with our controls independently tested.
UK GDPR
We process Reach data as a processor for our customers, under UK GDPR and the Data Protection Act 2018.
Reach Privacy Notice
Built for the most sensitive records
Reach holds records about survivors, children and people in crisis. These are the commitments we make about that data.
UK-hosted
Data stays in UK data centres.
Permission-aware
People, and the Case Assistant, only see what they are allowed to see.
Never used to train AI
Nothing is sent to a public AI service, and your records never train any model.
Independently certified
ISO 27001 and Cyber Essentials Plus, audited by third parties.
Documents
Each document has a permanent address. When we issue a new version, the old one stays available, because your contract refers to the version you signed.
- Legal
Reach Standard Terms
- Legal
Reach Terms of Use
- Privacy
Reach Privacy Notice
- Privacy
Sub-processor List
- Certification
Certificates
- Privacy
Cookie inventory
Need more detail? Ask us.
We don’t publish how Reach is built and defended. Customers and organisations evaluating Reach can request it here.
Sent to your work email
Request with your work email address and we’ll send you a link to the documents.
- Security Overview
- AI Statement
- Backup schedule
- Data retention statement
More available on request
Tell us what you need and a member of our team will be in touch.
- Penetration test summary
- Information security policies
- Business continuity and disaster recovery summary
Request documents
Who processes data for us
The companies that process Reach customer data on our behalf, what they do and where. We give customers at least 30 days’ notice before adding or replacing one. The formal list is the Sub-processor List above.
| Sub-processor | What they do | Data location |
|---|---|---|
| Microsoft (Azure) | Hosting, storage and the Case Assistant’s language models | United Kingdom |
Common questions
Which version of the terms applies to us?
The version named on your signed Order Form. Every version we have issued stays available here at its own permanent address, so you can always find the exact text you agreed to.
Why aren’t your security documents public?
They describe how Reach is built and defended. Publishing them openly would help anyone looking for a way in, so we share them with customers and organisations evaluating Reach on request.
How will we hear about a new sub-processor?
We email customers at least 30 days before a new or replacement sub-processor starts handling your data, which gives you time to raise an objection under your contract.
Do you hold SOC 2?
No. We hold ISO/IEC 27001 and Cyber Essentials Plus. If your tender asks for another standard, email us and we will explain how our controls map to it.
Who do we contact about a security or privacy concern?
Email info@paloma.co.uk. Mark the subject “Security” or “Privacy” and it goes straight to the right person.