When procurement teams at large organisations evaluate new software, security questionnaires have become a standard part of the process. And rightly so. The questions they ask (such as about encryption, access controls, incident response, supplier risk, data sovereignty) aren't bureaucratic box-ticking. They're probing for something substantial: whether the vendor has genuinely embedded security into how they operate, or whether they're applying a thin veneer of compliance over processes that haven't fundamentally changed.
At SimplyDo, we work with organisations in government, healthcare, and defence where the bar for these answers is high. This post sets out what our security posture actually looks like, not as a response to a questionnaire, but as an honest account of what we do and why.
Foundations: Policy, Standards, and Documented Practice
Security starts with documentation. Not because documents make organisations safe, but because the process of developing and maintaining them forces clarity about how things should work, surfaces gaps, and creates the shared understanding that makes consistent practice possible.
SimplyDo is aligned with ISO 27001, the international standard for information security management. This shapes everything from our secure development processes and code review practices to physical security, data disposal, backup management, and acceptable use policies for our team. It's a framework we use not just to satisfy external auditors, but because it provides a coherent structure for thinking about security systematically rather than reactively.
We also hold Cyber Essentials Plus certification, which addresses the most common vectors for cyber attack: boundary firewalls, secure configuration, access control, malware protection, and patch management. Cyber Essentials is increasingly a baseline requirement for UK public sector supply chains, and for good reason: the controls it requires are practical, well-understood, and genuinely effective against the threats most organisations face most of the time.
Encryption: At Rest, In Transit, and Reviewed
Data handled by SimplyDo is encrypted both in transit and at rest, using current cryptographic standards. We maintain a cryptographic register, a documented record of the algorithms and key management practices in use across our systems, and this is subject to regular review to ensure that our approach remains current as standards and recommendations evolve.
Encryption is sometimes treated as a single checkbox. We treat it as an ongoing practice that requires active maintenance: reviewing key rotation, monitoring for deprecated algorithm recommendations, and ensuring that the principles applied at the system level extend consistently to integrations and data pipelines.
Penetration Testing and Secure Deployment
Identifying vulnerabilities before they can be exploited requires more than internal review. SimplyDo commissions regular third-party penetration tests, structured attempts by independent security professionals to find weaknesses in our platform and infrastructure. Findings are tracked, remediated, and reviewed to ensure that issues don't recur.
Our deployment and delivery processes are designed with security as a built-in consideration, not an afterthought. Secure development practices govern how code is written, reviewed, and released, with controls in place to prevent vulnerabilities from being introduced at the development stage and to catch them before they reach production.
Backup, Recovery, and Business Continuity
Availability is part of security. An organisation that suffers a data loss event or an extended outage faces real consequences (operational, financial, and reputational) and understanding how a vendor manages these risks is a legitimate question for any enterprise customer.
SimplyDo's backup approach follows the 3-2-1 principle: three copies of data, on two different media types, with one stored offsite. Our recovery objectives, both Recovery Time Objective (RTO) and Recovery Point Objective (RPO), are defined and subject to SLA commitments, so customers have clear expectations rather than vague assurances.
Business continuity and incident response plans are documented, reviewed regularly, and tested. Testing matters here: a plan that has never been exercised is an assumption, not a capability. We treat business continuity planning as an active practice, not a document filed and forgotten.
Data Sovereignty and Regulatory Compliance
For organisations in regulated sectors (particularly in the UK public sector, healthcare, and defence) where data is processed and stored is not a minor detail. It affects regulatory compliance, procurement eligibility, and in some cases legal obligations.
SimplyDo understands data sovereignty requirements and the regulatory context within which our customers operate, including UK GDPR and sector-specific data protection obligations. We are clear about where data is held, what jurisdictions it passes through, and what controls govern access to it. These aren't questions we encounter for the first time on a security questionnaire, they're part of how we design and operate the platform.
User Privilege, Access Control, and Audit
The principle of least privilege (i.e. giving users and systems access only to what they need, and no more) is fundamental to limiting the impact of any security incident, whether caused by an external attacker or an internal error.
SimplyDo operates with a defined user access matrix, with staff roles and permissions documented and reviewed. Privileged access is monitored and audited. Changes to access rights are tracked. For organisations with their own governance requirements around user access this provides a clear and auditable picture of who has access to what, and on what basis.
Supply Chain Security
Security doesn't stop at the boundary of SimplyDo's own systems. The software, services, and infrastructure we use to build and run the platform each represent a potential risk, and understanding and managing that risk is part of operating responsibly.
We maintain an approved vendor list and conduct due diligence on suppliers, including security scorecards where appropriate. We map what data flows where, where personally identifiable information is present, and who has access to it at each point. Dependencies (including open-source libraries and third-party components) are tracked and reviewed for known vulnerabilities. This supply chain mapping isn't a one-time exercise; it's monitored and maintained as our systems and supplier relationships evolve.
Staff Training and Ongoing Vigilance
Technical controls are only as effective as the people operating them. SimplyDo's team undergoes regular security training, covering the practical and evolving threat landscape: phishing, social engineering, secure handling of data, and the specific responsibilities that come with working with sensitive customer information. Checklists and procedural controls support consistent practice across the team, including for onboarding new staff and for routine security-relevant activities.
What This Means for Customers
The practical effect of taking all of this seriously is that working with SimplyDo is, in our experience, a more straightforward process for security-conscious organisations than working with vendors who haven't invested in this infrastructure.
Security questionnaires get answered clearly and completely, because the answers exist and are documented. Due diligence conversations are faster because there are no gaps to paper over. Customers can be confident that their data is handled consistently with their own policies and obligations, which matters not just for their own assurance, but for their ability to demonstrate compliance to their own stakeholders and regulators.
For organisations in government, healthcare, and defence, where security and data governance aren't optional features but baseline requirements, we want to be a vendor that makes the security conversation easy, not one that makes it harder.
If you're at the stage of evaluating SimplyDo and want to discuss our security posture in more detail, we're ready for that conversation.
.jpg)
