TRUST & PROCUREMENT
What your procurement team will ask
Everything a supplier review usually asks for, in one place. If your process needs something that isn’t here, email hello@tektonsystems.co.uk and we’ll answer your questionnaire directly.
THE COMPANY
- Trading name
- TEKTON
- VAT
- Not VAT registered: our invoices carry no VAT
ASSURANCE
Our security policies are written against ISO/IEC 27001:2022 Annex A. TEKTON does not itself hold ISO 27001 or SOC 2 today. The providers that run our production systems do, and their audit reports are available to you on request:
| Provider | Runs | Independent assurance |
|---|---|---|
| Vercel | Hosting and edge network | SOC 2 Type II · ISO/IEC 27001 |
| Neon | PostgreSQL database | SOC 2 Type II · ISO/IEC 27001 |
| GitHub | Source control | SOC 2 Type II · ISO/IEC 27001 |
| Stripe | Payments | PCI DSS Level 1 · SOC 2 Type II |
| Resend | Transactional email | SOC 2 Type II |
- — Multi-factor authentication on every administrative account; named access only, reviewed quarterly.
- — Card payments run on Stripe’s hosted checkout: we never see or store card numbers.
- — Daily database backups with point-in-time recovery, held in the London region.
WHO DOES THE WORK
Every engagement is led by TEKTON’s principal engineer, who is accountable for it from survey to handover. Specialist associates join where the work needs them, engaged under written contracts with confidentiality and IP assignment, and supported by our own survey, monitoring and reporting systems.
DATA HANDLING
- — Client data is stored in the UK (London region) wherever our providers allow it, encrypted in transit (TLS 1.2+) and at rest.
- — Access to your systems is read-only unless agreed in writing, granted per person, logged, and removed at the end of the engagement.
- — Logs you send us are reduced to aggregates and literal-free query shapes; the raw files are not kept.
- — Personal data is processed only under a UK GDPR Article 28 data processing agreement, signed before work starts.
- — The full detail is on our security page.
SUB-PROCESSORS
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting for this site and our client cockpit (London region) | UK / EU, US parent |
| Neon (Databricks) | Managed PostgreSQL database (London region) | UK |
| Resend | Transactional email (enquiry notifications, reports) | EU (Ireland) |
| Stripe | Card payments and invoices | UK / EU |
| Google (Places, PageSpeed) | Public business listings and public page-speed scores | Global |
| GitHub | Private source-code hosting for client builds | US |
SERVICE LEVELS (ENTERPRISE SLA)
| Severity | Meaning | First response | Update cadence |
|---|---|---|---|
| P1 | Production down or data at risk | 1 hour, inside the agreed window | Every 2 hours until resolved |
| P2 | Major function impaired, workaround exists | 4 working hours | Daily |
| P3 | Minor issue or change request | 1 working day | As agreed |
These are our standard targets; your SLA schedule fixes the window, the hours and any service credits.
CONTINUITY: IF SOMETHING HAPPENED TO US
- — You own the code, infrastructure-as-code and documentation, and they live in repositories you control, not ours.
- — Every build ships with runbooks good enough for another competent team to operate it.
- — Credentials are held in your own accounts and password manager, never only in ours.
- — Source-code escrow is available for engagements that need it.
DOCUMENTS ON REQUEST
- — Master services agreement and sample statement of work, with acceptance criteria and SLA schedule
- — Data processing agreement (UK GDPR Article 28), with technical and organisational measures
- — Information security policy pack: access control, secure development, incident response, continuity
- — Security questionnaire answers (SIG Lite, CAIQ, or your own format)
- — Insurance certificates and company documents, once listed above