Alpha Creative Solutions, which operates CommsPliant, is registered with the UK Information Commissioner's Office.
ICO Registered
(UK) as data controller
Current
Security and trust, built into the way CommsPliant works.
CommsPliant is built for regulated communication workflows where access, approvals, data handling and evidence matter.
Our security and privacy controls cover the platform, the people who can access it, the way communications move through review and approval, and what happens if something goes wrong.
We document, test and review those controls as the platform develops.
Built on Trust
A foundation of security, privacy and reliability
CommsPliant combines security, privacy, governance and operational resilience into one controlled platform for regulated communications.
Trust at a Glance
Current
The core CommsPliant production environment is hosted in DigitalOcean's London LON1 region.
UK Production Hosting
Current
MFA is implemented for platform users and mandatory for privileged accounts.
Multi-Factor Authentication
Implemented
Permissions are enforced in the application backend so users can only perform actions allowed by their role.
Role-Based Access Control
Implemented
Organisation boundaries are enforced server-side to keep customer environments separated.
Tenant Isolation
Implemented
Security and audit events are logged, with continuous infrastructure and server monitoring.
Security Monitoring
Operational
A documented incident-response process is in place and has been exercised through a tabletop test.
Incident Response
Tested
CommsPliant operates a documented UK GDPR compliance framework covering data mapping, processing records, data processing agreements, retention and deletion, data-subject rights, DPIA screening, subprocessor governance and incident response.
UK GDPR
Implemented
No badge without the work behind it. We only claim certifications and independent assurance once they have actually been achieved.
Key Focus Areas
Security
Access control, tenant protection, monitoring, testing and secure development.
View security controls
Privacy & Data Protection
UK GDPR, customer-data use, retention, rights and privacy governance.
View privacy information
Data Flow
See how templates, customer data, generation, output and evidence move through CommsPliant.
View data flow
DigitalOcean
- Provider
- DigitalOcean
- Purpose
- Production infrastructure and hosting
- Location
- London LON1, United Kingdom
- Status
- Current
Resilience & Availability
Backup, restore, monitoring, incident response and business continuity.
View resilience details
Trust Resources
Security, privacy and due-diligence information in one place.
View trust resources
Amazon Web Services / Amazon SES
- Provider
- Amazon Web Services / Amazon SES
- Purpose
- Transactional email delivery, where selected and enabled
- Location
- Production region confirmed before live client processing
- Status
- Planned for production use where selected and enabled
Report a Security Issue
A clear route for reporting a genuine security concern.
Report a security issueTested & Evidenced
View Trust ResourcesCore supporting security controls are implemented, with final internal readiness checks remaining before formal certification.
Most underlying controls, policies, risk-management processes, testing and evidence framework are already in place. Final readiness refinements remain before formal certification.
Internal vulnerability, authentication/brute-force and traffic/DDoS testing is performed regularly.
A suspicious-login and traffic-flood tabletop exercise was completed on 25 August 2026 with a pass result.
About this Trust Center
CommsPliant's Trust Center brings together the security, privacy, resilience and governance information most relevant to clients, procurement teams and security reviewers.
The overview shows our current position. Detailed controls and supporting information are available through the linked Trust Center pages, with additional controlled material available where appropriate during onboarding or due diligence.
Explore Trust Resources
Secure by design
Security controls are built into the platform and workflow.
Governed
Documented controls, testing and regular review.
Transparent
Clear trust information and documented security practices.
Built for regulated organisations
Suitable for regulated and compliance-sensitive communication workflows across sectors.
Worldwide
Hosting can be configured to support client and jurisdictional requirements.
Accountable
Defined access, ownership, monitoring and review.
FAQ
The core production environment is hosted on DigitalOcean infrastructure in London LON1.
CommsPliant processes the customer data needed to generate the communication requested by the client. Personally identifiable information used for generation is not retained by default.
CommsPliant uses role-based access control, MFA, server-side tenant isolation, HTTPS/TLS, restricted production access, monitoring and documented privacy and security controls. Longer-term storage of completed communications or related customer data is used only where separately agreed.
Use the CommsPliant Contact page to request security, privacy or due-diligence information.
Still have questions?
If you need more detail about CommsPliant's security, privacy, data handling or supporting evidence, contact us and we'll help.
Request more information