IDDQD
Trust centre

Security and compliance at IDDQD.

Certificates, policies and subprocessors for procurement and security reviewers. Everything here applies group-wide. Where a brand differs, we link its own terms.

ISO/IEC 27001:2022, certified group-wide since 2020
ISO 27001
Cyber Essentials, certified group-wide
Cyber Essentials

Certifications

ISO/IEC 27001:2022

CertifiedHeld since 2020
Download certificate
Certificate
21/0344
Certification body
Centre for Assessment Ltd
Issued
22 Nov 2024
Expires
18 Jan 2028
Scope
All processes, activities and employees related to our core service of address search and validation in the remote work environment.

Cyber Essentials

Certified
Awarded
21 Oct 2026
Issued through
IASME
Certificate
Available on request
Request certificate

Updates

Certifications, audits and responses to major vulnerabilities.

All updates
  1. Certification

    Cyber Essentials certified

    IDDQD holds Cyber Essentials, the UK government-backed scheme for baseline cyber security, alongside its ISO/IEC 27001:2022 certification.

    Read the announcement
  2. IST-122
    Security advisory

    Node.js October 2026 security release, including Brotli flaw CVE-2026-111497

    Closed out

    Node.js fixed 10 vulnerabilities on 21 October. The Node.js project says the most serious, in the Brotli decoder, allows remote code execution. The fix was deployed two days after release.

    Opened
    23 Oct 2026 - closed 23 Oct 2026
    Findings
    Exposure on incoming requests was low, because the API does not decode Brotli. Outgoing connections could still be affected, so the fix was applied regardless. No evidence of exploitation was found.
    Actions taken
    Affected production services were rebuilt on the fixed Node.js release, verified and redeployed.
  3. IST-121
    Security advisory

    PHP2Shell: critical PHP remote code execution (CVE-2026-109618, CVE-2026-109619)

    Closed out

    A critical flaw allows unauthenticated remote code execution through any web-facing PHP runtime. No exposure was found in IDDQD services.

    Opened
    21 Oct 2026 - closed 30 Oct 2026
    Findings
    No PHP runtime serving web traffic was found on the systems examined, so the attack path is absent. The same assessment covers the related CVE-2026-115560. No evidence of compromise was found at monitored suppliers, and no breach notification was received.
    Actions taken
    Servers, container clusters and web server configuration were examined for PHP. Key suppliers were monitored from 22 to 29 October. The issue was closed as not applicable.
  4. Audit

    Passed the 2026 ISO/IEC 27001 audit

    An independent audit confirmed IDDQD's ISO/IEC 27001:2022 certification for another year, covering every service in the group.

    Read the announcement
  5. IST-81
    Security advisory

    React Server Components remote code execution (CVE-2025-55182)

    Closed out

    A critical flaw, rated CVSS 10, allows remote code execution through React Server Components and Next.js. One IDDQD website ran an affected version, but the flaw could not be exploited there. The website was patched within two days of disclosure.

    Opened
    04 Dec 2025 - closed 05 Dec 2025
    Findings
    One public website ran an affected version, but the flaw could not be exploited there. The other websites assessed were not exposed, as they ran unaffected versions or did not use server components.
    Actions taken
    IDDQD websites and documentation sites were assessed. The website on the affected version was patched and the issue was closed on 5 December 2025.

Controls

How we host, protect and recover the services behind our APIs: 59 controls in 11 areas.

Compliance and assurance

ISO 27001 certified, Cyber Essentials certified, Annual independent audit, Annual penetration testing, Statement of Applicability available5
ISO 27001 certified
IDDQD has held ISO/IEC 27001 certification since 2020 and recertifies every three years. It is certified to ISO/IEC 27001:2022 by Centre for Assessment Ltd (certificate 21/0344, expires January 2028). The scope covers all processes, activities and employees related to our core service of address search and validation, in a remote work environment.
Cyber Essentials certified
IDDQD was awarded Cyber Essentials certification on 21 October 2026, issued through IASME.
Annual independent audit
An accredited certification body audits the ISMS every year. Internal audits run at least annually and their findings go to management review.
Annual penetration testing
An independent tester runs penetration tests against our APIs and public websites every year. The latest test was in May 2026. A summary report is available on request.
Statement of Applicability available
Our Statement of Applicability sets out which ISO 27001 Annex A controls apply and how they are met. It is available on request.

Governance and risk

Named security owner, Policies approved and reviewed, Risk management, Insurance, Legal and regulatory requirements tracked5
Named security owner
The Information Security Manager runs the ISMS day to day. An Information Security Committee provides oversight and acts as the emergency response team.
Policies approved and reviewed
Management approves information security policies. They are communicated to all staff and relevant third parties and reviewed at least annually.
Risk management
Risks are identified, scored and treated under a documented risk management framework. The Management Team assesses risk twice a year and whenever significant change occurs. Risks and treatments are tracked in a risk register with named owners.
Insurance
IDDQD holds Professional Indemnity insurance with a limit of £1,000,000 any one claim, Employers' Liability insurance of £10,000,000 and Public and Products Liability insurance of £5,000,000. Certificates are available on request.
Legal and regulatory requirements tracked
Legal, regulatory and contractual requirements are held in a register and reviewed as part of the ISMS.

People

Pre-employment screening, Confidentiality agreements, Security awareness training, Disciplinary process, Leavers5
Pre-employment screening
Staff with access to information assets are screened before they start, including identity, right to work, references and a criminal record check.
Confidentiality agreements
Employees and contractors sign confidentiality agreements before accessing systems or data. Contractors are held to the same security policies and controls as employees.
Security awareness training
All staff complete information security training on joining and annually after that. Training includes annual ISMS awareness, GDPR and AI training.
Disciplinary process
A formal disciplinary process covers breaches of security policy.
Leavers
A documented leavers process removes access and recovers company assets when someone leaves or changes role.

Access control

Multi-factor authentication enforced, Least privilege, Access reviewed every six months, Unique accounts and managed passwords, Production access, Customer API key controls6
Multi-factor authentication enforced
MFA is mandatory for all user and administrative access to cloud services and systems that hold or process company or customer data. Services that cannot support MFA may not hold confidential or personal data.
Least privilege
Access is role-based and granted on a need-to-know, least-privilege basis. Asset owners authorise access, and every grant is recorded.
Access reviewed every six months
Access rights are reviewed every six months, in February and August. Organisation-level MFA enforcement is verified for each service at the same review.
Unique accounts and managed passwords
Every user has a unique account, and shared accounts are not permitted. Passwords are generated and stored in a central password manager.
Production access
Production infrastructure is reached only over an authenticated, encrypted private network. SSH uses certificate authentication, and password logins are disabled.
Customer API key controls
Where a service issues API keys, customers can restrict them to named domains, set daily lookup caps with alerts at 90% and 100%, rate-limit by IP address and rotate or revoke keys at any time from the dashboard.

Data protection

Data we process, Controller and processor roles, ICO registered, Data location, International transfers, AI and monitoring vendors do not receive lookup data, Data retention, Deletion on exit, Encryption, Customer separation, No live data in testing11
Data we process
Customers send address search queries (postcodes and partial addresses), and our services return address data. Requests carry the caller's IP address. Account data covers the organisation's contacts and billing details.
Controller and processor roles
IDDQD processes address lookups as a processor on the customer's behalf, and is the controller of its own customer account data. Data Processing Agreements are public across our commercial brands.Ideal Postcodes DPAAddressZen DPA
ICO registered
IDDQD is registered with the UK Information Commissioner's Office, registration ZA310960.
Data location
Where data is processed and stored depends on the brand. Check the terms and subprocessor list for the brand you use.Ideal Postcodes subprocessorsAddressZen subprocessors
International transfers
Where a transfer outside the UK or EEA arises, Standard Contractual Clauses apply, as set out in section 6 of the Data Processing Agreement.Ideal Postcodes DPAAddressZen DPA
AI and monitoring vendors do not receive lookup data
Address lookup data is not sent to the AI assistant, product analytics or error monitoring vendors on our subprocessor lists.
Data retention
Address query data is redacted within 28 days by default. Customers can shorten this period, or set it to 0 days so search terms are not retained at all. Server logs are kept for 28 days. Account data is kept only as long as contractual and legal obligations require.
Deletion on exit
When a customer leaves, IDDQD deletes or returns their personal data on request, in line with the Data Processing Agreement.Ideal Postcodes DPAAddressZen DPA
Encryption
Data in transit is encrypted with TLS 1.2 or higher. Staff devices use full-disk encryption, and backups and logs are encrypted at rest.
Customer separation
Query data is partitioned by customer and stored separately from account data.
No live data in testing
Development and test environments are separate from production and do not use live personal data.

Subprocessors and suppliers

Subprocessor list, Subprocessor changes, Supplier assessment3
Subprocessor list
Each service's terms site publishes its current subprocessor list, with each subprocessor's activity and location.Ideal Postcodes subprocessorsAddressZen subprocessors
Subprocessor changes
New subprocessors are added to the lists before they start processing, and additions are made on the first of the month. Customers have 14 days from an update to object on reasonable grounds.
Supplier assessment
Every supplier is risk assessed before it gets access to IDDQD information. Suppliers are bound by written agreements, including data processing agreements where personal data is involved, and reviewed periodically.

Infrastructure and network

Cloud hosted, no data centres of our own, Remote-first, Perimeter protection, Network segmentation, Intrusion detection and monitoring, Hardened configuration6
Cloud hosted, no data centres of our own
Our services run on several cloud providers in multiple regions. IDDQD runs no data centres or on-premises servers, and data centre physical security sits with providers that hold ISO 27001 or equivalent certification.
Remote-first
IDDQD is a remote-first company. No customer data is held in an office.
Perimeter protection
Public services sit behind a web application firewall with DDoS mitigation. Every server runs a host firewall that denies inbound traffic by default.
Network segmentation
Servers are segmented by function. Development, test and production run on separate networks.
Intrusion detection and monitoring
Every managed server runs a security agent for intrusion detection, file integrity monitoring and vulnerability detection. Logs are collected centrally, and alerts page on-call staff.
Hardened configuration
Servers are provisioned from version-controlled infrastructure code and run only the services they need. Services run with least privilege, and default accounts and passwords are removed.

Devices

Device management, Malware protection, No customer data on devices3
Device management
Devices are centrally managed through mobile device management, with full-disk encryption, a firewall, enforced automatic updates and screen lock. They can be wiped remotely.
Malware protection
Endpoints run built-in anti-malware with automatic signature updates and allow only signed software. Removable media is prohibited.
No customer data on devices
Customer data stays in cloud systems and is not stored on staff devices.

Secure development

Secure development lifecycle, Code review, Change control, Vulnerability scanning, Patching within 14 days, Vulnerability disclosure6
Secure development lifecycle
Software is built under a Secure Development Policy following OWASP guidance. All development is in-house.
Code review
Substantial code changes must pass automated tests and checks, and be approved by a reviewer independent of the author, before they are merged.
Change control
Changes to production follow a change control procedure that covers security impact, testing and approval.
Vulnerability scanning
An automated daily check scans dependencies and container images for known vulnerabilities. It raises a fix for every finding rated CVSS 7.0 or above, and flags runtimes near end of life.
Patching within 14 days
Security updates for vulnerabilities rated CVSS 7.0 or above, or that the vendor rates critical or high, are installed within 14 days of release. Every logged vulnerability is resolved, or closed as not applicable with a recorded reason, within 14 days.
Vulnerability disclosure
Report security issues privately to security@iddqd.org.

Incidents and continuity

Incident response plan, Breach notification, Business continuity plan, Recovery targets, Backups, Uptime and status6
Incident response plan
A documented incident handling procedure covers reporting, categorisation, containment, evidence collection, root cause and post-incident review. Every incident is logged and tracked to closure.
Breach notification
If a personal data breach affects a customer, IDDQD notifies that customer without undue delay. Where required, IDDQD reports it to the ICO within 72 hours.
Business continuity plan
A business continuity plan covers loss of systems, suppliers and key staff. It is tested through planned exercises and simulations, and updated after tests and real incidents.
Recovery targets
Internal recovery targets for customer-facing services are a 1-hour recovery time and a 1-hour recovery point. These are internal targets, not contractual commitments.
Backups
Databases are backed up to a separate location, encrypted and access-controlled. Backups are tested monthly.
Uptime and status
Service status is published on public status pages. An optional Enterprise SLA commits to 99.9% uptime with service credits.

Artificial intelligence

AI policy, Approved AI vendors only, AI in our services3
AI policy
An AI Policy governs every AI tool, from chat assistants to agents. It requires an approved vendor, least-privilege access granted by a named person, human approval of irreversible actions and verification of output. All staff complete AI training annually.
Approved AI vendors only
AI vendors go through the same risk assessment as other suppliers. Personal data may enter an AI tool only if the vendor has a data processing agreement and complies with GDPR, and only the personal data the task needs. Credentials never go into AI tools.
AI in our services
AI and machine learning are used to improve address search and matching. AI does not make decisions about individuals.

Documents

Subprocessors and terms

Contact

Report a vulnerability or ask for further documents at security@iddqd.org.

Email security team