DataCops Ltd Information Security Policy
EFFECTIVE DATE: August 25, 2026
1. Purpose and scope
This policy describes how DataCops Ltd ("we", "us") protects the systems we operate and the data our customers entrust to us. It applies to all DataCops production systems, all personnel with access to them, and all customer data processed by the DataCops platform.
2. Access control
Access to production systems follows least privilege. Production credentials and API secrets are never stored in source code; they live in encrypted secret storage and reach servers only through automated deployment pipelines. Repository and infrastructure accounts are protected with two-factor authentication. Direct changes to production servers are restricted by policy: changes ship through version-controlled, auditable CI pipelines.
3. Data protection
All data in transit is encrypted with TLS, including per-customer first-party tracking domains, each served with its own certificate. Customer API keys are stored as salted hashes and cannot be read back after creation. Where personal data is transmitted to advertising platforms for measurement, identifiers are hashed with SHA-256 before transmission wherever the destination platform supports it. Visitor identity tokens are cryptographically signed with keys derived per customer, so a token issued for one customer can never be validated by, or linked across, another. We never join or share visitor identities across customers.
4. Consent and data minimization
Data collection respects the visitor's consent state, enforced server-side. Marketing destinations receive personal data only for visitors with explicit consent. Bot and fraud traffic is filtered before personal data reaches any downstream destination. We collect the data needed to provide the service and no more.
5. Data subject rights and deletion
We maintain an operational data subject access request (DSAR) pipeline. Erasure requests remove or anonymize the subject's data in our systems, invalidate their identity tokens, and are propagated to connected destination platforms under the customer's controllership. Customers can disconnect any integration at any time, which deletes the stored credentials for it.
6. Infrastructure and subprocessors
Production workloads run on hardened Linux servers hosted with established European infrastructure providers. Core subprocessors include OVHcloud (hosting), Cloudflare (network, DNS and edge delivery) and GitHub (source control and deployment automation). A current subprocessor list is available on request at [email protected].
7. Monitoring, logging and auditability
Every conversion delivery attempt, including skipped and failed attempts and the reason for them, is written to an append-only audit log. Production services are monitored, and delivery health alerts notify the team when an integration degrades. Logs do not store raw payment credentials; we never collect card numbers or passwords from tracked visitors.
8. Incident response
Security reports are received at [email protected] and are triaged by the founding team, who own production access. In the event of an incident affecting customer data we contain the issue, assess scope from audit logs, notify affected customers without undue delay, and where required notify supervisory authorities in line with UK GDPR timelines.
9. Vulnerability reporting
We welcome good-faith security research. Report suspected vulnerabilities to [email protected]. We will acknowledge receipt, investigate, and keep the reporter informed. We do not pursue action against good-faith research conducted without harm to customer data or service availability.
10. Review
This policy is reviewed and updated by the founding team as the platform evolves, and at least annually. Questions about this policy: [email protected].
