Trust Centre
Vamiq's Trust Centre: data residency, DPA, sub-processors, security controls and an honest account of certification status, in one place for reviewers.
Everything on this page is true today and verifiable — live links, published documents, and an honest account of where certification stands. Bookmark it for your security review.
Privacy & regulatory coverage
UK & EU — GDPR
Data Processing Agreement with 72-hour breach notification, published sub-processor list with 30-day change notice, and enforced retention windows. No analytics runs today; if we add website analytics, it will not run for visitors who have not allowed it. Data is hosted in Glasgow, UK. Daily backups are kept on the same server in Glasgow; encrypted off-server backups in the EU are being set up.
India — DPDP Act, 2023
Grievance Officer with a 72-hour acknowledgement commitment, Data Protection Board notification duty embedded in our incident procedure, and consent withdrawal as simple as giving it.
United States — CCPA/CPRA and state privacy laws
We do not sell or share personal information. For customer workspace and device data we act as a service provider, processing it solely to deliver the service. Vamiq is not designed for PHI and does not offer a BAA.
Employee transparency
Every enrolment page tells the device user exactly what their organisation can see (managed apps, device facts, security posture) and cannot see (personal apps, location, photos, messages, browsing). We build the notice in, so our customers' transparency duties are easier to meet.
Security controls
Encryption
TLS for all traffic with HSTS. AES-256-GCM encryption at rest, in the application, for Apple Business tokens and keys, workspace push certificates, device push and unlock tokens, secrets entered in built-in configuration-profile types, webhook signing secrets, and integration connection credentials; the keys are derived from a server-side secret held outside the database. Passwords are bcrypt hashes, and every password is checked against known breaches when it is set.
Tenant isolation
Every signed-in request is checked on the server: the workspace comes from the user's session, queries on customer data are filtered to that workspace, and changes re-check that the record belongs to it. Roles and permissions are checked before protected actions. PostgreSQL row-level security policies are also defined in the database schema. They are not relied on at runtime today; making them effective as a second layer behind the application checks is on our engineering backlog.
Access control & destructive-action governance
Role-based access with dedicated per-action device permissions. Destructive device actions (clear passcode, erase) require a stated reason, typed device-name confirmation, and step-up re-authentication — with optional two-person approval for erase. Every action lands in an append-only, exportable audit trail.
Data minimisation by design
Managed devices report managed apps only — never a personal app inventory. No device location is collected. Employee email is optional at enrolment. When a device leaves management, its personal fields are anonymised on an enforced schedule.
No AI in deployment decisions
Deployment Intelligence is deterministic: fixed rules, named evidence sources, reproducible outcomes. No model decides what installs on your devices — decisions are auditable line by line, with no EU AI Act exposure.
Transparency & operations
Live service status
Component-level health and 90-day history, published from the same retained telemetry our availability figures are calculated from — the status page and our published availability figures cannot disagree.
Sub-processors
The complete list — who, what data, and where — reviewed quarterly, with 30 days' notice and a right to object before any addition or replacement.
Open API
A documented public REST API with per-workspace scoped keys and signed webhooks. The OpenAPI contract is public — no account needed to read it.
Responsible disclosure
Report vulnerabilities to security@scotitech.com. We acknowledge within two business days, triage within five, keep reports confidential until a coordinated disclosure is agreed, credit reporters who want it, and offer safe harbour for good-faith research within scope. A machine-readable contact file follows RFC 9116.
Certification status
Where we are
Vamiq is not yet certified to SOC 2 or ISO 27001. Today you can review the records themselves: device records, the audit log of who did what in your workspace, and checksummed Evidence Packs of what was released.
Enterprise review
Enterprise customers can request a full control review before production rollout, including our security summary, a countersigned copy of our DPA, and an annual security questionnaire response.