Security posture

Native Teams is a technology company that designs, builds and operates digital platforms used by businesses and individuals around the world. Our products bring together workflows, documents, data and financial features in one place, and the people who use them trust us with information that matters. For us, security is not a feature added at the end. It is an engineering discipline that shapes how we design our architecture, write our code, run our infrastructure and support our users.

This page explains how we approach security across our products, from governance and secure engineering to infrastructure, monitoring, incident response and the partners we work with. Our information security management system is independently certified to ISO/IEC 27001:2022, and our Platform is tested regularly by independent security specialists.

Our security at a glance

Designed around the data we protect

Our platforms process many kinds of information, and not all of it carries the same risk. We classify the data our products handle and design our controls accordingly. Information such as identity documents, financial details and other sensitive personal data is subject to the strongest access restrictions, is visible only to the users and team members who need it, and is protected by additional safeguards wherever it is stored or transmitted.

Security across the lifecycle of your data

We think about security at every stage of the journey your information takes through our Platform.

Governance and certification

Security across our products and operations is managed through a formal information security management system, independently certified to ISO/IEC 27001:2022 by an accredited certification body. The system defines clear roles and responsibilities, a set of information security and data protection policies, and a structured approach to identifying, assessing and treating risks.

Our controls are reviewed through regular internal audits and management reviews, and the certification body audits our system every year to confirm that it continues to meet the standard. Security is overseen by senior leadership, so that it is considered in business decisions rather than treated as a purely technical matter.

Protecting your data

Encryption

Information is encrypted in transit between your device and the Platform, and between the services that make up the Platform, using modern TLS protocols. Information is also encrypted at rest in our databases, storage and backups, using industry-standard encryption. Encryption keys are managed securely and access to them is tightly restricted.

Data minimisation and retention

We design our services to collect and keep only the information that is needed. Personal information is processed in line with our Data Processing Agreement and our Privacy Policy, and it is retained only for as long as necessary to provide our services and to meet legal obligations, such as legal record-keeping requirements.

Separation of client data

The Platform is designed so that each client's information is logically separated from that of other clients, and so that users can access only the information that belongs to their own organisation and is permitted by their role.

Controlling access

Access for our team

Access to systems that hold client information is granted on the basis of role and the principle of least privilege, so that our team members can access only the information they need to do their jobs. Access to our internal systems is protected by multi-factor authentication, access rights are reviewed regularly, and access is removed promptly when a person changes role or leaves the company. Privileged access to production systems is restricted to a small number of authorised team members and is logged.

Access for your team

The Platform gives your organisation control over who can see and do what. Administrators can invite users, assign roles and permissions, and remove access at any time. High-impact actions are protected by confirmation and approval steps, so that they cannot happen without the right person's authorisation. Multi-factor authentication is available to protect user accounts.

Building a secure Platform

Secure development

Security is considered throughout our software development lifecycle, from design to deployment. Changes to our code are peer-reviewed before they are released, our development, testing and production environments are kept separate, and real client data is not used for development or testing. We keep the third-party libraries and components we use up to date, and address known vulnerabilities in a timely manner.

Independent testing

Our web application and related services are tested regularly by an independent security firm. Testing is carried out using recognised industry standards, including the OWASP Web Security Testing Guide, the OWASP Top 10 and the OWASP API Security Top 10, and includes authenticated testing across different user roles. Findings are reviewed, prioritised and remediated, and a summary attestation is available to clients on request.

Vulnerability management

We scan our systems for vulnerabilities, apply security updates promptly, and welcome reports from security researchers through our Vulnerability Disclosure Policy.

Securing financial features

Some of our products include financial features, which are delivered together with regulated banking and payment partners operating under their own authorisations and security requirements. We protect these features with the same engineering principles that apply across our platforms: users are verified before financial features are enabled, high-impact actions require explicit confirmation and appropriate approval, and activity is monitored to detect unusual behaviour and potential fraud. Card data is handled by our card issuing partners in line with the Payment Card Industry Data Security Standard.

Infrastructure and hosting

The Platform runs on infrastructure provided by leading cloud providers, which maintain recognised security certifications for their data centres and physical security. Our environment is protected by network segmentation, firewalls, protection against malicious software and defences against denial-of-service attacks. Infrastructure changes are controlled, and security updates are applied in a timely manner.

Monitoring and incident response

We monitor our systems and applications to detect suspicious activity, errors and potential security events. Logs of system and user activity are collected and retained to support investigation and review.

We maintain a documented incident response process that defines how security incidents are reported, assessed, contained, investigated and resolved, who is responsible at each stage, and how we learn from each incident afterwards. If an incident affects personal information that we process on behalf of a client, we notify the client without undue delay, as set out in our Data Processing Agreement, and we work with the client to meet any obligations it may have to notify authorities or individuals.

Resilience and business continuity

We design the Platform to be resilient. Data is backed up regularly, backups are encrypted and stored securely, and our ability to restore them is tested. We maintain business continuity and disaster recovery plans that set out how we keep critical services running and recover from disruption, and we review and test these plans periodically.

Our people

Security depends on people as much as technology. Everyone at Native Teams receives information security and data protection training when they join and at regular intervals afterwards, including guidance on recognising phishing and social engineering. Everyone who works with client information is bound by confidentiality obligations, and, where the law allows, we carry out background checks for roles with access to sensitive systems. Our Code of Conduct sets out the standards we expect from everyone who works with us.

Our suppliers and partners

We work with carefully selected technology and service providers, including cloud infrastructure, identity verification and financial services partners. Before engaging a provider that will handle client information, we assess its security and data protection practices, and we put contracts in place that require appropriate safeguards and confidentiality. We continue to monitor our key providers throughout our relationship with them. Providers that process personal information on behalf of our clients are listed among our sub-processors, and we notify clients of changes in accordance with our Data Processing Agreement.

Artificial intelligence

Where we use artificial intelligence, the same security and data protection standards apply. AI tools are approved before use, access to data is limited to what each tool needs, and we do not allow third-party AI providers to use client data to train their general-purpose models. Our Responsible AI Policy explains where we use AI, where we do not, and the safeguards we apply.

Shared responsibility

Security works best as a partnership. We are responsible for securing the Platform and the infrastructure on which it runs. You are responsible for how your organisation uses the Platform, including who has access and what they can do.

Report a security issue

If you believe you have found a security vulnerability in the Platform, please report it to us at security@nteams.com, in accordance with our Vulnerability Disclosure Policy. Please give us reasonable time to investigate and fix the issue before sharing it publicly, and do not access, change or share any data beyond what is needed to demonstrate it. We appreciate the work of security researchers and respond to every report.

Learn more

Our Certificates page describes our ISO/IEC 27001 certification and independent testing, and explains how to request security documents. Our Data Processing Agreement sets out our technical and organisational security measures in more detail, and our Talk to Data Protection page explains how to contact our data protection team.