Security at InsightOS
We protect your workforce data with ICO-registered data handling practices, strong encryption, multi‑factor authentication, and UK GDPR-aligned processes – so you can focus on growing your business.
Data Protection
End‑to‑end encryption for data at rest and in transit. Strict access controls and full tenant isolation ensure your data stays private.
Secure Infrastructure
Security-conscious infrastructure management. Regular monitoring, updates, and secure hosting – built for reliability and peace of mind.
Access Control & 2FA
Role‑based permissions and strong authentication. We support multi‑factor authentication (2FA) via Google Authenticator and Microsoft Authenticator – an extra layer of security for every user.
Data Handling & Retention
Export, delete, or retain data on your terms. You stay in full control with transparent data lifecycle management.
Backups & Reliability
Regular, automated backups and a resilient architecture designed to protect against data loss and ensure business continuity.
GDPR & Compliance
Registered with the UK Information Commissioner's Office (ICO), reg. ZC197993. We act as a data processor and process data in line with UK GDPR.
Responsible Use
For features such as email outreach, users are responsible for complying with applicable laws and regulations when contacting third parties. We provide the tools – you stay compliant.
Contact us
Have a security question or concern? Reach out to our team — we’re here to help.
support@insightos.co.uk
Security details
InsightOS Security
At InsightOS, security is built into the platform from the ground up. We protect customer data using layered technical, organisational and operational controls across our application, infrastructure and development processes.
We aim to provide businesses with a secure platform for managing workforce, HR and operational information while maintaining transparency about how InsightOS protects data.
Infrastructure & hosting
InsightOS is hosted on infrastructure provided by IONOS, with our primary application infrastructure located within the European Union. Our infrastructure is designed to restrict access to authorised systems and personnel and is monitored for security and operational events.
Data protection at rest: Customer and application data stored within our infrastructure is protected using AES-256 encryption at rest where supported by the underlying storage infrastructure.
Encryption in transit: Connections to InsightOS are protected using HTTPS/TLS encryption. We do not intentionally transmit customer information over unencrypted HTTP connections.
Access control
InsightOS uses role-based access controls to restrict what users can access within the platform. Permissions can be applied according to a user's role and responsibilities, helping ensure that users only have access to information and functionality relevant to them. Administrative and privileged access is restricted and controlled separately from ordinary user access.
Authentication & account security
- Secure authentication mechanisms
- HttpOnly authentication cookies where applicable
- Multi-factor authentication (MFA)
- Email-based MFA options
- Role-based permissions
- Session and authentication controls
- IP-based security controls
- Rate limiting
- Account and access monitoring
Login & security monitoring
InsightOS maintains security monitoring around authentication and account activity. Our security dashboard monitors relevant security events, including login activity and other authentication-related events. Security information is automatically reviewed and processed as part of our operational security monitoring.
InsightOS uses automated systems to generate periodic security reports, including an overnight security report containing relevant security activity and login information. Depending on the event, security monitoring may include successful login activity, failed authentication attempts, account activity, IP address information, authentication events, security-related system activity and potentially unusual access patterns.
IP blocking & rate limiting
InsightOS uses IP-based controls and rate limiting to help protect the platform against repeated authentication attempts, automated abuse, excessive requests, suspicious traffic and certain denial-of-service and brute-force patterns. Where appropriate, IP addresses or requests may be temporarily or permanently blocked based on security signals.
Database security
Access to InsightOS databases is restricted to authorised application services and authorised administrative access. Database credentials and infrastructure access are not exposed to ordinary InsightOS users. Access controls are applied to infrastructure and database systems to reduce the risk of unauthorised access.
Backups, storage & AI security
InsightOS performs regular backups of critical application data. Backups are maintained using IONOS Cloud infrastructure and are designed to support recovery in the event of system failure, data corruption or another operational incident. Backups are subject to access controls and security protections appropriate to the underlying infrastructure.
InsightOS uses Bunny.net for certain media storage and content delivery functionality. Where customer or user-uploaded media is stored or delivered through these services, the relevant processing and security arrangements of the provider apply alongside InsightOS's own application-level controls.
InsightOS uses artificial intelligence to provide features such as reporting, analysis, assistance and other AI-powered functionality. Where third-party AI services are used, InsightOS takes account of the security and data-processing arrangements of the relevant provider. Customer data is not intentionally submitted to public AI services for general model training.
Google reCAPTCHA
InsightOS uses Google reCAPTCHA Enterprise to help protect forms, authentication and other areas of the platform from automated abuse. reCAPTCHA may process information such as device, browser, IP and interaction information for security and abuse-prevention purposes.
Security development practices
- Server-side authentication and authorisation
- Input validation
- Access control checks
- Secure session handling
- Rate limiting
- Database access controls
- HTTPS/TLS
- Security monitoring
- Error and activity logging
- Dependency and infrastructure maintenance
- Controlled production access
Security incident response
If InsightOS identifies a suspected security incident, we follow an incident response process designed to identify and assess the incident, contain affected systems or accounts, investigate cause and scope, determine whether personal data has been affected, take remedial action, document the incident and notify affected customers or regulators where legally required.
Data protection & location
InsightOS is designed to support businesses that may process personal information relating to their workforce. Customers remain responsible for determining the lawful basis and appropriate use of personal data within their organisation. InsightOS processes customer data in accordance with the applicable Data Processing Addendum and the customer's documented instructions.
InsightOS's primary application infrastructure is hosted within the European Union. Some third-party services used by InsightOS may involve processing outside the UK or European Economic Area, and where a restricted international transfer applies, InsightOS uses an appropriate legally recognised transfer mechanism and supplementary safeguards where required.
Personnel & administrative access
Access to production systems and sensitive information is restricted to authorised personnel who require access for legitimate operational, development, support or security purposes. Administrative access is controlled and monitored. Personnel with access to confidential information are expected to maintain confidentiality and follow applicable security procedures.
Continuous improvement
Security is an ongoing process. InsightOS continuously reviews its application, infrastructure and security controls and may introduce additional protections as the platform develops. Our automated security monitoring and reporting provides an additional layer of oversight by allowing security-related activity to be reviewed regularly.
Responsible disclosure
If you believe you have discovered a security vulnerability in InsightOS, please contact us promptly rather than attempting to exploit the vulnerability or access another user's information.
Security contact: support@insightos.co.uk
When reporting a potential vulnerability, please provide enough information for us to reproduce and investigate the issue safely.
Compliance & documentation
InsightOS maintains documentation and processes designed to support compliance with applicable data protection and security requirements:
Contact
For questions regarding security, privacy or data protection, contact InsightOS Data Protection & Security Officer at support@insightos.co.uk. For information about how InsightOS processes personal data, please see our Privacy Policy.
Last updated: October 2026