PocketSurvey Ltd - Our Commitment to Security and Operational Resilience

At PocketSurvey Ltd, we're committed to safeguarding our data, systems, and operations to ensure the trust of our clients and the continuity of our services. This page outlines our comprehensive approach, including our information security policy and our plan for maintaining resilience in the face of unforeseen events. Further details on our data privacy practices, compliance, and specific technical measures will be provided in dedicated sections.

PocketSurvey Ltd - Information Security Policy

Effective Date: May 9, 2025
Reviewed: Annually (or more frequently if required)

1. Purpose

This policy outlines PocketSurvey Ltd's commitment to protecting its information assets and ensuring the confidentiality, integrity, and availability of all data, systems, and services. It aims to minimise risks from security threats, comply with relevant regulations (e.g., GDPR), and maintain trust with our clients and partners.

2. Scope

This policy applies to all employees, contractors, temporary staff, and any third parties who access PocketSurvey Ltd's information systems or handle company data, regardless of location or device.

3. Key Principles

Confidentiality: Only authorised individuals shall have access to sensitive information.
Integrity: Information shall be accurate, complete, and protected from unauthorised modification or destruction.
Availability: Information and systems shall be accessible to authorised users when needed.

4. Policy Statements

Data Protection: All personal and sensitive data will be handled in accordance with the UK GDPR and other relevant data protection laws. Data will be collected, processed, and stored securely and only for legitimate business purposes.
Access Control: Access to company systems, networks, and data will be granted based on the principle of "least privilege" - users will only have access to the information and resources necessary to perform their job functions. All access will be authenticated and regularly reviewed.
Password Management: All users must use strong, unique passwords for all company systems and accounts. Passwords must meet minimum complexity requirements and be changed regularly. Multi-factor authentication (MFA) will be implemented where possible.
Device Security: All company-issued devices (laptops, mobile phones, etc.) must be protected with appropriate security measures, including strong passwords/biometrics, encryption, and up-to-date antivirus/anti-malware software. Personal devices used for work (BYOD) must also adhere to company security standards.
Network and Cloud Security: Our data and operations primarily leverage secure cloud services (such as Google Workspace) which provide their own robust security measures, including data encryption, access controls, and threat detection. All devices accessing these services must maintain up-to-date operating systems and security patches. Secure internet access is paramount, and public Wi-Fi networks should be used with caution, preferably via a Virtual Private Network (VPN) where sensitive data is involved.
Email and Internet Usage: Users must exercise caution when opening emails, clicking links, or downloading attachments, especially from unknown sources. Phishing attempts and suspicious activities must be reported immediately. Internet usage should be for legitimate business purposes.
Data Backup and Recovery: Critical business data will be regularly backed up to secure, off-site locations. A disaster recovery plan will be in place and tested periodically to ensure business continuity.
Incident Response: All security incidents (e.g., data breaches, malware infections, lost devices) must be reported immediately to [Designated Person/Department, e.g., IT Support/Management]. A clear process for responding to, investigating, and resolving security incidents will be followed.
Employee Training and Awareness: All employees will receive regular security awareness training to educate them on best practices, common threats, and their responsibilities under this policy.
Third-Party Security: Third-party vendors or service providers who access our systems or handle our data must demonstrate adequate security controls and comply with our security requirements.
Regulatory Compliance: PocketSurvey Ltd complies with applicable UK and EU data protection and IT security regulations, including UK GDPR. While we strive to meet best practices globally, we do not claim full compliance with all international security regulations.

5. Compliance and Enforcement

All employees are responsible for adhering to this policy. Non-compliance may result in disciplinary action, up to and including termination of employment, and potential legal consequences.

6. Policy Review

This policy will be reviewed at least annually, or more frequently if there are significant changes in technology, threats, or regulations.

PocketSurvey Ltd - Brief Disaster Recovery Plan

Purpose: To ensure the rapid recovery of critical business operations and data in the event of a disruptive incident (e.g., severe hardware failure, cyberattack, local office inaccessibility).

Key Principles:

Minimise Downtime: Aim to restore essential services and data as quickly as possible.
Prevent Data Loss: Prioritise the integrity and availability of all critical data.
Clear Communication: Ensure all staff and relevant stakeholders are informed during and after an incident.
CEO: Overall coordination of disaster response and recovery.
All Staff: Responsible for reporting incidents immediately and following recovery instructions.

Core Components:

1. Critical Data & Systems:

All critical business data (e.g., survey data, client information, financial records) is primarily stored and managed within secure cloud services (e.g., Google Drive, Google Workspace).
All company mobile devices and laptops are encrypted, reducing the risk of data compromise if a device is lost or stolen.
Regular backups of any locally stored critical data (if applicable) are maintained and sync to cloud services.

2. Recovery Procedures (in case of device failure or inaccessibility):

Loss of a Device: New, encrypted laptops/mobile devices will be provisioned. Staff will log in to Google Workspace to regain access to all cloud-based data and applications.
Loss of Office Access: As operations are primarily cloud-based, staff can continue working remotely from any location with internet access using their provisioned devices.
Cloud Service Outage (e.g., Google Workspace):
- Monitor Google's service status page for updates.
- Communicate with staff via alternative channels (e.g., personal mobile numbers, alternative email addresses), which are also accessible via encrypted mobile devices.
- Assess if any critical functions can be performed offline or using alternative minimal tools until service is restored.

3. Communication Plan:

Internal: Key contact list (including personal mobile numbers and alternative emails) is maintained securely online and accessible via encrypted mobile devices.
External: Identify key client/partner contacts and prepare pre-approved messages for status updates if a significant disruption occurs.

4. Roles & Responsibilities:

CEO: Overall coordination of disaster response and recovery.
All Staff: Responsible for reporting incidents immediately and following recovery instructions.

5. Review & Testing:

This plan will be reviewed annually and after any significant changes to our systems or operations.
Simple tabletop exercises will be conducted periodically to ensure staff understanding and plan effectiveness.

Privacy Policy

Our comprehensive Privacy Policy details how PocketSurvey Ltd collects, uses, protects, and manages your personal data. It also outlines your rights regarding your data. For full details, please visit our dedicated policy page:

PocketSurvey.org/privacy-policy.htm

Terms of Service

The Terms of Service define the terms and conditions governing your use of PocketSurvey Ltd's services and website. We encourage all users to review these terms carefully. You can find the complete document here:

PocketSurvey.org/terms-of-service.htm

Health and Safety Policy

PocketSurvey Ltd is committed to providing a safe and healthy working environment for all its employees, contractors, and visitors. As a small, remote-first company primarily using home offices, our policy focuses on promoting good ergonomic practices, identifying and mitigating common home office risks, and ensuring awareness of emergency procedures. All staff are encouraged to report any health and safety concerns to the CEO immediately.

Data Handling and Classification Policy

PocketSurvey Ltd classifies its data to ensure appropriate handling based on sensitivity. All data, especially personal or confidential information, is primarily processed and stored within our secure, encrypted Google Workspace environment. Access is strictly controlled based on roles and necessity. Data disposal is managed through secure cloud deletion processes and verified device wipes for company equipment.

Data Protection Policy (GDPR)

PocketSurvey Ltd is committed to protecting the privacy and security of personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO registration number ZA333198) and process personal data lawfully, fairly, and transparently. Our comprehensive privacy practices are detailed in our Privacy Policy available at pocketsurvey.org/privacy-policy.htm.

As a SaaS provider of property inspection and compliance applications, we process property-related data including addresses, survey data, and photos. We leverage Google Workspace's secure cloud infrastructure with encryption at rest and in transit, role-based access controls, and detailed audit logs. All company devices are encrypted to protect data. We conduct Data Protection Impact Assessments (DPIAs) to identify and minimise risks, and data is retained for the duration of client subscriptions or projects, then securely deleted in line with our data retention policy.

Individuals have the right to access, rectify, erase, restrict processing, and port their personal data. We respond to all data subject requests within one month. James Holroyd (CEO) holds overall accountability for data protection compliance, with specific duties assigned to all staff. Any queries or requests should be directed to the CEO immediately. We review this policy annually and provide all staff with regular data protection and cyber security training. In the event of a data breach, we will notify affected individuals and the ICO within 72 hours where required by law.

Acceptable Use Policy (AUP)

This policy governs the appropriate use of PocketSurvey Ltd's IT resources, including company-issued devices, cloud services (Google Workspace), and internet access. Users must only engage in lawful and professional activities, avoid unauthorized software installations, and protect company assets from misuse. Any suspicious activity or policy breach must be reported immediately.

Software and Asset Management Policy

PocketSurvey Ltd ensures all software used is legally licensed and kept up-to-date with security patches through automated updates where possible (e.g., for operating systems and Google Workspace applications). Company-issued laptops and mobile devices are inventoried, encrypted, and their security posture is regularly monitored. Disposal of devices follows secure data wiping procedures.

Supplier and Vendor Security Management

For any third-party suppliers or vendors who access our systems or provide critical services, we conduct due diligence to assess their security posture. We prioritize partners who align with our cloud-first, security-conscious approach, such as Google for core services. Contracts include clauses ensuring data protection and security responsibilities.

Change Management Policy

PocketSurvey Ltd implements a streamlined change management process for significant alterations to our IT systems and cloud configurations. Changes are planned, reviewed, and approved by the CEO or a designated lead, with communication to affected staff to minimize disruption and ensure security integrity.

Physical Security Policy

While PocketSurvey Ltd operates primarily remotely with cloud services, physical security remains important for company-issued devices. All laptops and mobile devices are encrypted and users are responsible for their physical security. Access to any shared physical workspaces or co-working spaces must adhere to secure access protocols, and devices should never be left unattended or unsecured.

Insurance Details

PocketSurvey Ltd holds comprehensive insurance coverage to protect our operations and stakeholders. We maintain £2 million in public liability insurance and £10 million in employer liability insurance.

For transparency, please find links to our insurance documentation below:

Public Liability Insurance: PocketSurvey.com/files/PL-Certificate.pdf
Employer Liability Insurance: PocketSurvey.com/files/EL-Certificate.pdf

Data Protection Impact Assessment (DPIA)

PocketSurvey Ltd conducts Data Protection Impact Assessments (DPIAs) to identify and minimise the data protection risks of its processing activities. Below is a summary of key aspects related to the data we process:

Data Protection Impact Assessment (DPIA) Summary

What data is being processed?

PocketSurvey collects and processes property-related data, including address, survey data, and photos. No sensitive personal data (like medical or financial info) is collected.

Who has access to the data?

Only authorised PocketSurvey users (e.g., surveyors, admin staff) and system administrators have access. Access is role-based and logged to ensure accountability.

Where is the data stored?

Data is stored securely in Google Workspace and other UK/EU-compliant cloud platforms. A PDF confirming Google Workspace data location and compliance is available in our internal documentation area.

How is data protected?

Data is encrypted at rest and in transit. We enforce secure login procedures, user-level permissions, and maintain detailed audit logs. Regular security reviews and backups are conducted to ensure ongoing protection.

How long is the data retained?

Data is retained for the duration of the client’s subscription or project, then securely deleted in line with PocketSurvey Ltd’s internal data retention policy.

Supplier Questionnaire Answers: Risk Assessment

Below are responses to common supplier questionnaire items, providing a summary of PocketSurvey Ltd's security and operational practices, further detailed in our policies.

External IT Supplier Information

PocketSurvey Ltd primarily uses Google Workspace as its core external IT supplier for cloud services, including data storage and collaboration. Our reliance on Google's inherent security features is noted in our Information Security Policy.

Information Security Certifications

PocketSurvey Ltd itself doesn't currently hold separate, dedicated information security certifications. However, as our core data and operations reside within Google Workspace, we leverage their extensive range of certifications and attestations, including ISO 27001, SOC 2/3, and GDPR compliance.

Approved Information Security Policies

PocketSurvey Ltd has an approved Information Security Policy in place, detailing our commitment to protecting information assets. These policies are publicly available at PocketSurvey.com/policies.htm.

Information Security Roles & Responsibilities

Information security roles and responsibilities are identified within PocketSurvey Ltd, with overall accountability held by Chris Holroyd (CEO) and specific duties assigned to all staff. Full details are outlined in our Information Security Policy at PocketSurvey.com/policies.htm.

Email Encryption

PocketSurvey Ltd uses email encryption. All emails sent and received via our Google Workspace (Gmail) platform are encrypted by default at rest and in transit using industry-standard protocols such as TLS. This ensures a secure connection for email communication.

Staff Data Protection & Cyber Security Training

PocketSurvey Ltd provides all staff with regular Data Protection and Cyber Security training, as outlined in our Information Security Policy at PocketSurvey.com/policies.htm.

Restricted Data & System Access

PocketSurvey Ltd restricts access to data and systems based on the "least privilege" principle, ensuring only authorised staff access. Details are in our Information Security Policy at PocketSurvey.com/policies.htm.

Multi-Factor Authentication (MFA)

PocketSurvey Ltd uses Multi-Factor Authentication (MFA). Our Information Security Policy states that MFA "will be implemented where possible" to enhance the security of our systems and accounts. Further details can be found in our policies at PocketSurvey.com/policies.htm.

Staff Security Checks (DBS/BPSS)

PocketSurvey Ltd doesn't routinely conduct DBS or BPSS checks for all staff, as these are primarily for roles involving vulnerable groups or government assets. We implement appropriate screening based on specific role requirements or client contracts.

Incident Reporting Policy

PocketSurvey Ltd has clear policies requiring all employees and temporary contract staff to report incidents, including potential security issues and near misses. Our Information Security Policy, available at PocketSurvey.com/policies.htm, mandates immediate reporting of all security incidents.

Sensitive Information Handling Policy

PocketSurvey Ltd has policies for secure storage, access, and handling of sensitive information. Our Data Handling and Information Security Policies, detailing encryption and least privilege access, are available at PocketSurvey.com/policies.htm.

Regular Patch Management

PocketSurvey Ltd ensures regular patch management. Our Software and Asset Management Policy confirms that all software, including operating systems and cloud applications, is kept up-to-date with security patches, primarily through automated updates where possible. You can find more details in our policies at PocketSurvey.com/policies.htm.

Laptop Encryption

PocketSurvey Ltd uses laptop encryption. Our Information Security Policy and Disaster Recovery Plan both explicitly state that all company-issued laptops and mobile devices are encrypted to protect data and minimise risk in case of loss or theft. You can find more details in our policies at PocketSurvey.com/policies.htm.

Annual Penetration Testing

PocketSurvey Ltd doesn't perform annual third-party penetration testing due to our small scale. We rely on the robust, certified security of our primary cloud provider, Google Workspace, combined with our internal security policies and regular reviews.

Sub-contracting

PocketSurvey Ltd primarily offers its service as a Software-as-a-Service (SaaS) solution, meaning the core functionality of property inspection and reporting is delivered directly via our platform. We do not typically sub-contract core services.