Compliance

ISO/IEC 27001 information security

Straight answer first: Sovereign Mail is not yet ISO/IEC 27001 certified. The data centre our servers sit in is, and we run our own controls in line with the standard while we work towards certification.

What ISO/IEC 27001 is

ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS) — a documented, independently audited framework for managing information-security risk across people, process and technology.

Where we're hosted

Both our application and our mail servers run on Brightbox, a UK-owned cloud provider based in Leeds. Brightbox's servers are in Manchester, in data-centre facilities managed by Teledata UK Ltd, which holds ISO 27001 certification (Brightbox's own statement).

That certificate covers the data-centre facility: physical security, power and building operations. It doesn't cover Brightbox's cloud platform, and it doesn't cover Sovereign Mail.

Our own controls

At the application layer we operate controls aligned to ISO 27001 Annex A themes:

• Access control — two-factor authentication (required to view sent messages), scoped and revocable API keys, secrets stored only as hashes.
• Cryptography — TLS 1.2+ in transit, per-domain DKIM signing, scrypt password hashing.
• Operations security — rate limiting, audit logging, separate servers for the application and for mail sending.
• Supplier management — a minimal, UK-based set of sub-processors.
• Data residency — all processing and storage in the UK.

Status

Our own ISO/IEC 27001 certification is on our compliance roadmap, after Cyber Essentials. We'll update this page when it's under audit, not before.