Data Processing
Last updated: 17 September 2026
This page explains how Secure Select Ltd handles personal data when we process it on a client’s behalf. It is a description of our approach, not a contract. Where you need a data processing agreement, we will sign one: email [email protected] and we will send our standard agreement, or work from yours.
When we are a processor, and when we are not
Most of what we do makes us a controller in our own right, and our privacy policy covers that. We become your processor when an engagement means we handle personal data belonging to your business, for example when we review a system that holds staff or customer records, run a phishing simulation against your people, or act as your retained security lead. In those cases we act only on your documented instructions, and the personal data remains yours.
What we commit to
- We process personal data only on your instructions, for the engagement, and for no purpose of our own.
- Everyone who works on your engagement is bound by confidentiality, and that obligation continues after the work ends.
- We apply appropriate technical and organisational measures: least-privilege access, multi-factor authentication, encryption in transit and at rest, and we take only the data an engagement actually needs.
- We tell you without undue delay if we become aware of a personal data breach affecting your data, and we help you meet your own reporting duties.
- We help you respond to requests from individuals exercising their rights, and with data protection impact assessments where you need them.
- At the end of an engagement we return or delete the personal data we hold for you, as you choose, except where we must keep a record by law.
- We will not appoint a new sub-processor for your data without telling you first and giving you the chance to object.
- We make available the information you need to demonstrate we are meeting these obligations, and we will accommodate a reasonable audit.
Sub-processors
These are the providers we use to run the business. They are the same list as in our privacy policy, because it should be.
| Provider | Purpose | Where |
|---|---|---|
| Vercel | Website hosting and server logs | UK and EU, with US parent |
| Supabase | Database for security check submissions | EU |
| Resend | Email delivery | US |
| HubSpot | Customer relationship management | EU and US |
| Upstash | Rate limiting, to stop the forms being abused | EU |
| Cloudflare | Public DNS resolver used by the free security check | Global |
| Website analytics, only where a visitor consents | US and global |
Where a sub-processor is outside the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy where it applies.
SecureCore
SecureCore is in development. It is designed to process security data entirely on your premises, so that telemetry never reaches us and no sub-processor sees it. We will publish the processing terms for it before it ships rather than describe a deployed product that does not yet exist.