For the bigger picture, start with AdviceAid security and compliance: start here.

Availability and uptime

  • AdviceAid has an availability target of 99.9%, which it has met every year since launch.

  • We run multiple instances of the application, with proactive alerting, to keep downtime to a minimum.

  • Maintenance windows: we practice continuous delivery, so minor updates can be safely released without downtime. Major upgrades are performed during out-of-hours maintenance windows, and during evenings and weekends.

Monitoring

We use cloud monitoring to track the uptime and availability of AdviceAid, and we alert on suspicious sign-in activity so we can respond quickly.

Backup

  • Data is backed up every day using an enterprise-class backup solution. Backups are encrypted.

  • Backup data is held in a separate location for geographical separation and kept for a 30-day retention period.

  • Restores are tested quarterly, so we know backups can be relied on.

Disaster recovery and recovery objectives

  • Recovery Time Objective (RTO): 12 hours. This is the time within which we expect the service to be restored after a failure.

  • Recovery Point Objective (RPO): up to 24 hours. Because backups run daily, the maximum data loss in a worst case is up to one day.

Business continuity

AdviceAid has a business continuity plan covering how the service is kept running, or restored, in the event of disruption.

Incident management

We have a documented incident management process and an incident response procedure, with escalation available around the clock. The process covers detecting, containing, resolving and learning from incidents that affect the service or its data.

Reporting a security incident or data breach

  • As your data processor, we notify your council, as the controller, without undue delay if a personal data breach affects your data.

  • The contact point for reporting a cyber incident to us is Peter McGuire, peter.mcguire@adviceaid.uk.

  • To date, AdviceAid has not had a personal data breach that required notification to the ICO.

Who to contact

For questions about resilience, disaster recovery or incident handling, contact Peter McGuire at peter.mcguire@adviceaid.uk