Security & Compliance
Over 600 governments and public sector organisations have trusted us with their most important consultations and the data that comes with them.
Security, privacy and accessibility aren’t checkboxes we tick before a release. They’re design constraints we work within from the very start of every build.
What sets us apart
- Certified and assured: We’re ISO 27001:2022 and Cyber Essentials certified. A CHECK-registered vendor penetration tests the platform every year, and the report is available on request.
- UK data, UK hosting: Data for UK customers is hosted on AWS in UK datacentres. It’s encrypted in transit with TLS 1.3 and at rest with AES-256, including all backups.
- Accessible by design: Citizen Space is tested to WCAG 2.2 Level AA, including screen readers, keyboard access and colour contrast. We’re advised by Tetralogical, who also advise GOV.UK.
Our approach
We believe in:
- You own your data: you’re the data controller and Delib is the data processor
- Privacy by Design, as advocated by the ICO, with tools to help you meet every data subject right under UK GDPR
- Granular control: layered permissions, two-factor authentication, single sign-on, and configurable password and session policies
- Responsible AI: analysts can edit or override every output, and AI never changes original response data or makes decisions for you
- No lock-in: export your data at any time, with no exit fees
A reliable service
We target 99.95% availability, with 24/7/365 monitoring and service credits if we fall short. Full backups run at least every 24 hours, are kept for up to 60 days and are restore-tested monthly. Our business continuity plan is tested at least once a year.
Updates ship at least six times a year, after formal version control, automated and manual QA, and testing in isolated staging environments. Maintenance happens overnight, usually takes under 10 minutes, and customers are always told in advance.
.avif)
Who we are
We’re a for-profit social enterprise with a team of around 30 people across the UK, USA, Australia and New Zealand. All staff are background checked to BPSS standard or equivalent.
Our customers stay with us for an average of 7 years, and more than 600 organisations worldwide use our tools, including UK central government departments, regulators and the ICO.
