GDS Client Portal
These are the technical and organisational measures GDS Analytics applies to the GDS Client Portal under Article 32 of the UK GDPR. They form part of every portal customer’s contract, and we will not reduce them during a customer’s term.
Measures
| Area | Measures |
|---|---|
| Governance | Security is owned by Marc Davies (CISSP, CCSP, CISA, CISMP), Director. This statement is reviewed at least annually and after any significant change to the Service. |
| Sign-in | Every user signs in with a password and an authenticator app. Disabled accounts are refused at every request, not only at sign-in. |
| Customer separation | Each customer’s plans, DPIAs, records and supplier portfolios are visible only to that customer’s users and to authorised GDS administrators. Separation is tested before each release. |
| Document storage | Uploaded files are stored with random names in a private folder outside the public website, and are served only to signed-in users of the customer they belong to. File contents are checked on upload, so a file disguised as a PDF is refused. |
| Audit trail | A tamper-evident audit log records sign-ins, publications, downloads, refused access attempts and administrative changes. The SHA-256 hash of each published document is recorded. |
| Monitoring server | The scanning server has no public login page and accepts administration over SSH only. It talks to the portal with a token restricted to its own IP address, and can only read the supplier list and send results. It holds supplier domains, not customer personal data. |
| Encryption | All traffic to the portal uses TLS 1.3. Data at rest is encrypted with AES-256. |
| Backups | Daily backups of the database and the private document folder, encrypted and stored in Dublin, Ireland, with at least one copy held separately from the live server so that it cannot be altered or deleted from it. Daily backups are kept for 35 days and weekly backups for 12 weeks, so no backup outlives the 90-day deletion commitment in the Data Processing Agreement. A sample restore is tested every quarter and a full restore at least once a year. |
| Patching | Security updates to WordPress core, plugins and server packages are applied within 72 hours for a vulnerability known to be exploited or rated critical (CVSS 9.0 or above), within 14 days for one rated high (CVSS 7.0 to 8.9) or given no rating, within 30 days for medium and within 90 days for low. |
| Vulnerability management | GDS monitors its own domain on the same platform it offers to customers, and runs continuous automated adversarial testing. A penetration test by a CREST-accredited or NCSC CHECK-approved provider is carried out at least once a year and after any significant change to the Service. |
| Incidents | GDS follows a documented incident response procedure and notifies affected customers within 48 hours of becoming aware of a personal data breach, as set out in the Data Processing Agreement. |
| People | Everyone with access to customer data is bound by confidentiality and given access only where their role requires it. |
| Certification | GDS is working towards ISO/IEC 27001:2022 certification, with a target of the third quarter of 2027. This statement will be updated with the certificate number and scope once certified. |
Changes and contact
We publish each new version of this statement on this page. If a change would reduce the protection a customer has, it does not apply to that customer until their next renewal. The sub-processors we use are listed in Annex B of the Data Processing Agreement, and the service itself is described in the service description.
To report a security concern about the portal, email admin@gdsanalytics.co.uk.
© 2026 GDS Analytics. All rights reserved.