It points you to the right answer for each topic, and includes our responses to all 14 of the NCSC Cloud Security Principles. For the bigger picture, start with AdviceAid security and compliance: start here.

The single most useful thing to know before you start: AdviceAid holds no citizen personal data, only your staff members' names and email addresses for sign-in. A large share of standard supplier questions can be marked not applicable for that reason. The out-of-scope list in the start-here article sets out which ones.

Where to find each answer

If your council uses its own questionnaire, match each section to the article that answers it:

Anything not covered there, we are happy to answer directly. Contact details are at the end.

Data Protection Impact Assessment (DPIA)

Your council is the data controller and completes the DPIA. We provide the information you need to fill it in. The key facts:

  • Personal data processed: staff names and email addresses, for sign-in. Where an adviser emails an advice sheet, the recipient's email address is processed for delivery only.

  • No special category data, and no citizen records.

  • Hosting and location: Microsoft Azure, UK region. All council data stored in the UK.

  • Sub-processors: Microsoft Azure (UK) for hosting and database; Amazon Web Services (Amazon SES, London region) for outbound email.

  • International transfers: none outside the UK.

  • Retention: staff credentials are held for the life of the licence; backups are kept for 30 days.

  • Data subject rights: your council manages user accounts directly and can add, amend or delete them; we assist where needed.

Data Processing Agreement (DPA) and processor terms

AdviceAid acts as your data processor, with your council as the controller. We can sign your council's DPA, or provide our own processor terms. Either way, our standard processor commitments are:

  • We process personal data only on your documented instructions.

  • We keep the data confidential and apply appropriate security measures.

  • We are transparent about sub-processors (listed above).

  • We assist you with data subject rights requests and with any personal data breach.

  • We return or delete data at the end of the contract.

  • We cooperate with reasonable audit requests.

NCSC Cloud Security Principles: our responses

For councils that assess suppliers against the NCSC's 14 Cloud Security Principles, here are our responses. Each points to the article with the detail.

1. Data in transit protection. All connections use HTTPS on port 443 with TLS 1.2 or higher. HSTS is enabled, and public sites hold an A+ rating on Qualys SSL Labs. See Hosting.

2. Asset protection and resilience.

  • Physical location and jurisdiction: hosted in Microsoft Azure, UK region, under UK law.

  • Data centre security: Microsoft's UK data centres provide physical access controls and certified protection.

  • Data at rest: Azure Transparent Data Encryption; daily encrypted backups held in a geographically separate location.

  • Data sanitisation and equipment disposal: AdviceAid uses managed cloud resources and no removable media. On exit, data is removed from the live environment and backups cycle out within 30 days. Underlying hardware is disposed of by the cloud provider under their certified processes.

  • Availability: 99.9% target, met every year since launch, with multiple instances and proactive alerting. See Hosting and Resilience.

3. Separation between consumers. AdviceAid is multi-tenant SaaS. Customer data is separated at application level by a unique organisation ID, so users only see their own organisation's data. See Hosting.

4. Governance framework. We maintain a documented security governance framework, with policies covering cyber security, data protection and breach handling, and a security risk register. See Assurance.

5. Operational security.

  • Configuration and change management: the cloud estate is defined as infrastructure as code, all software is in source control, and changes go through change control with rollback.

  • Vulnerability management: monthly external vulnerability scanning against the OWASP Top 10 and other vulnerabilities, with remediation prioritised by severity (critical within 7 days, high within 14 days), plus independent penetration testing by Evalian, a CREST- and CHECK-accredited provider.

  • Protective monitoring: cloud monitoring of uptime and availability, with alerting on suspicious sign-in activity.

  • Incident management: a documented incident process with escalation available around the clock. See Assurance and Resilience.

6. Personnel security. Administrative access is limited to a small number of named Neatlines staff. All staff sign a confidentiality agreement and complete regular security awareness training. See Assurance.

7. Secure development. Software is managed in source control, the cloud environment is infrastructure as code, frameworks and dependencies are kept current, and changes go through change control with separation of duties. See Assurance.

8. Supply chain security. We use established, reputable providers: Microsoft Azure (UK) and Amazon Web Services (Amazon SES, London). See Hosting.

9. Secure consumer management. Sign-in uses single sign-on to your Microsoft Entra ID, so your own MFA and conditional access apply. Where a password is still used, it is encrypted. Management of the platform uses multi-factor authentication and least-privilege access. See Access.

10. Identity and authentication. An Admin account defined by your council can add, view, amend and delete user accounts. Three roles are available (Advisor, Author, Admin). Access logs can be provided on request. See Access.

11. External interface protection. The only external interfaces are the public-facing web applications, protected by HTTPS and HSTS. See Hosting.

12. Secure service administration. Administration uses least-privilege IAM controls, privileged access management, trusted devices, and audit information for checking unexpected activity. See Access.

13. Audit information for consumers. Access logs and a record of administrative actions can be provided to your council on request. See Access.

14. Secure use of the service. AdviceAid is SaaS, so your council is not responsible for configuring the security of the service. We manage that for you. See Start here.

What we can provide on request

  • Our responses to your specific questionnaire.

  • Our penetration testing schedule, and a summary of results.

  • Accessibility information.

  • A signed DPA or our processor terms.

Who to contact

For procurement, security or data protection questions about AdviceAid, contact Peter McGuire at peter.mcguire@adviceaid.uk