Security Policy

Skylark Control Ltd | Date Created: 07-05-2026 | Last Updated: 22-05-2026

1. Purpose and Scope

This Security Policy documents the technical and organisational measures (TOMs) applied by Skylark Control Ltd to protect personal data and other information assets processed through the Skylark Platform. It is the document referred to as the "Security Policy" in the Skylark Control Master Data Processing Agreement (MDPA) and is incorporated into the MDPA and the Platform Terms and Conditions by reference.

• Master Data Processing Agreement (MDPA)
  - https://admin.skylarkcontrol.com/legal/master-data-processing-agreement.pdf

• Platform Terms and Conditions
  - https://admin.skylarkcontrol.com/legal/terms-of-service.html

This document covers:

• The Skylark Platform and all associated infrastructure, APIs, and tooling
• The internal systems and processes used by Skylark Control staff in delivering the Platform
• Third-party sub-processors engaged to process Customer Data on Skylark Control's behalf

This Policy is a companion document to:

• The Skylark Control Customer Data Retention & Erasure Policy (CDEP1), which governs data classification, access controls, retention, and deletion procedures
• The Skylark Control Appropriate Policy Document (APD), which governs special category data processing
• The Skylark Control Master Data Processing Agreement (MDPA), which governs the contractual framework for customer data processing

Where this Policy and those documents address the same matter, the CDEP1 and APD provide the operational procedural detail; this Policy provides the technical security controls. There is no conflict between them.

This Policy must be made available to customers on request and is published at https://admin.skylarkcontrol.com/legal/security-policy.html

Skylark Control's Chief Executive Officer is the executive sponsor of the ISMS and has committed adequate resources to its implementation, maintenance, and continual improvement.

2. Information Security Certifications

3. ISO 27001

Skylark Control holds ISO 27001 certification for its information security management system (ISMS). The certification covers the design, development, operation, and support of the Skylark Platform and associated infrastructure.

The ISMS is reviewed no less than annually by senior management. The scope, risk register, Statement of Applicability, and audit findings are maintained by the Information Security Officer and are available to customers under the audit provisions of the MDPA.

2. Cyber Essentials Plus

Skylark Control holds Cyber Essentials Plus certification, independently verified through external technical testing.

Cyber Essentials Plus certification is renewed annually. The most recent certificate is available to customers on request.

3. Infrastructure and Cloud Security

4. Cloud Environment

The Skylark Platform is hosted on DigitalOcean. Primary production infrastructure (compute, database, storage, networking) is deployed in the DigitalOcean LON1 (London) region within the United Kingdom. AWS S3 is used as a secondary off-site backup storage location only — it does not host any primary platform service. No Customer Data is processed or stored outside the United Kingdom or European Economic Area unless an appropriate transfer mechanism is in place as identified in the Sub-processor Register.

2. Network Security

The following network security controls are applied to the Skylark Platform production environment:

• All external traffic is routed through a Web Application Firewall (WAF) configured to detect and block common web application attacks including OWASP Top 10 categories

• Network segmentation is enforced through DigitalOcean Virtual Private Cloud (VPC) configuration; production, staging, and development environments are isolated and cannot communicate directly

• Ingress and egress traffic is restricted to defined ports and protocols; all other traffic is denied by default

• Intrusion detection monitoring is applied to production network traffic; alerts are reviewed by the operations team within 2 hours.

• DDoS protection is provided by the DigitalOcean Network Gateway and Load Balancer in front of all inbound platform traffic, including both API endpoints and static-content delivery. This mitigation is considered adequate for operational continuity purposes, including for customers operating in 24/7 environments

3. Vulnerability Management

The Company maintains awareness of known vulnerabilities affecting the Skylark Platform through a combination of DigitalOcean security advisories and platform monitoring, vendor security bulletins, software composition analysis of third-party dependencies (Section 4.3), and findings from penetration testing (Section 11).

Where a vulnerability is identified, it is triaged by the Information Security Officer, recorded in the risk register, and remediated within the following SLAs:

• Critical and high severity: within 14 days
• Medium severity: within 30 days
• Low severity: within 90 days

Third-party penetration testing of the Skylark Platform is conducted no less than annually in accordance with Section 11 of this Policy.

4. Application Security

5. Privacy by Design

The Skylark Platform is developed under a Privacy by Design approach. The following measures are applied as part of platform design and ongoing operation:

• Data minimisation — input forms, integration interfaces, and data submission workflows are reviewed against the principle that only data which is directly relevant and necessary for the specified purpose is collected. Optional or unnecessary fields are removed, and data submission templates are reviewed at each platform release

• Pseudonymisation — where technically feasible, personal identifiers are stored separately from operational data sets so that analytics, monitoring, and non-production use cases can operate without access to identifying personal data. The reversal mapping is restricted to authorised platform services and personnel

• Restriction by default — access to personal data, particularly Special Category Data, is restricted by default through role-based access control, with access granted only where there is an authorised purpose. See Section 5.2 (Role-Based Access Control)

• Encryption — personal data is encrypted at rest and in transit, with additional application-layer encryption applied to Special Category Data. See Section 6 (Encryption)

2. Secure Development Lifecycle

Security is integrated into the software development lifecycle (SDLC) at the following stages:

• Design — security requirements and threat modelling are completed for all new features handling personal data or introducing new access patterns before development commences

• Development — developers follow the Skylark Secure Coding Guidelines, which address input validation, output encoding, authentication, session management, error handling, and logging

• Review — all code changes are subject to peer review before merging; changes to authentication, access control, cryptographic, or data handling code require review by a senior engineer

• Testing — automated security testing (SAST and DAST) is applied as part of the CI/CD pipeline; builds with critical or high severity findings are blocked from deployment

• Deployment — production deployments are gated behind an approval process; automated rollback is available for all deployments

3. Dependency Management

Third-party libraries and dependencies are tracked using software composition analysis (SCA) tooling. Dependencies with known vulnerabilities are flagged automatically and remediated in accordance with the vulnerability SLAs in Section 3.3.

4. API Security

Interactive access to the Skylark Platform is authenticated as set out in Section 5.1 (Authentication Requirements). Programmatic access through the Skylark Platform APIs is authenticated using scoped API keys issued to authorised integrations. The following controls apply to API access:

• API keys are issued with scoped permissions on the principle of least privilege

• Unused or expired API keys are automatically revoked

• Rate limiting is applied to all public API endpoints to prevent abuse and to protect against credential-stuffing and brute-force attempts

• All API requests are logged with timestamp, source IP, and operation; logs are retained in accordance with the Retention Register in CDEP1 §12

5. File Upload Security

The Skylark Platform accepts file uploads from customers (for example, medical fitness certificates and operational documents). The following controls apply to all uploads:

• All uploaded files are scanned for malware before being made available within the Platform
• Files that contain executable scripting components — including, but not limited to, scripted PDFs, macro-enabled office documents, and HTML or JavaScript payloads — are blocked at upload and not stored
• The Platform does not execute customer-uploaded files server-side; uploaded files are stored for retrieval and download only
• Customers remain responsible for the lawfulness and accuracy of files they upload, in accordance with the acceptable use provisions of the Terms

5. Authentication and Access Control

6. Authentication Requirements

The Skylark Platform authenticates users through password-based login combined with multi-factor authentication (MFA). The following requirements apply to all Skylark Platform accounts and internal systems:

• Password complexity — passwords must meet defined minimum complexity rules (length and character-class requirements). Submitted passwords are additionally checked against a dictionary blacklist of commonly compromised, breached, or weak passwords; matching passwords are rejected at registration and at password change.

• Multi-factor authentication (MFA) — MFA is mandatory for all staff accounts and all customer administrator accounts. The second factor is delivered as a one-time code sent to the user's verified email address or mobile number.

• Brute-force protection — failed login attempts are rate-limited at the authentication endpoint. After 10 consecutive failed authentication attempts the account is locked and may only be unlocked through the documented account-recovery procedure, which requires identity verification.

• Session expiry — authentication tokens expire by default every 2 hours and must be regenerated by an authenticated user session. User sessions expire after 12 hours regardless of activity.

• Password storage — passwords are stored as BCrypt-hashed values. Plain-text secrets (including passwords, API keys, and MFA codes) are never transmitted or stored unencrypted.

2. Role-Based Access Control

Access to Customer Data and platform functions is controlled through a role-based access control (RBAC) model. Roles are defined on the principle of least privilege: each role grants only the minimum access required to perform its associated functions. Role assignments are reviewed quarterly by the relevant Information Asset Owner and the Information Security Officer.

3. Privileged Access Management

Access to production infrastructure and systems is restricted to a named list of authorised personnel. Privileged access is:

• Granted only for defined operational purposes and reviewed no less than quarterly
• Subject to MFA and session recording where technically feasible
• Time-limited for break-glass and incident response scenarios; access is revoked immediately on conclusion

Skylark staff do not access Customer Data without the prior sign-off of the designated Information Asset Owner, in accordance with Section 6.2 of the CDEP1.

4. Joiners, Movers, and Leavers

• New starters are granted access only after completion of onboarding checks, including completion of mandatory security training
• Access permissions are reviewed and updated within 1 working day of a role change
• All access is revoked within 4 hours of a leaver's departure being confirmed; this includes platform access, infrastructure access, and third-party tool access

6. Encryption

7. Encryption at Rest

All Customer Data stored on the Skylark Platform is encrypted at rest using AES-256 encryption. Encryption is applied at the storage layer by default across DigitalOcean services used in the production environment (managed databases, block storage volumes, and Spaces object storage). Backup copies held in AWS S3 are encrypted at rest using AES-256 server-side encryption.

Special Category Data (medical fitness certificates) is subject to additional application-level encryption, providing a second layer of protection independent of the storage layer. The encryption key for Special Category Data is managed separately from other platform keys.

2. Encryption in Transit

All data transmitted between clients and the Skylark Platform, and between internal platform components, is encrypted in transit using TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled. HTTP connections are redirected to HTTPS. TLS certificates are issued and renewed automatically through Let's Encrypt on a 60-day renewal cycle; renewal failures generate an alert to the operations team for investigation prior to certificate expiry.

3. Key Management

Encryption keys are managed by the underlying cloud platform encryption services: DigitalOcean's native key management service for primary platform services, including SSH key management for the VPC bastion host; and AWS Key Management Service (AWS KMS) for S3 server-side encryption of off-site backup data. The following key management controls apply:

• Encryption keys are rotated no less than annually

• Key access is restricted to the minimum set of platform services and personnel required

• Key usage is logged and monitored; anomalous access patterns generate alerts

• Key rotation and access events are recorded in the audit log

4. Cryptographic Erasure

Cryptographic erasure — permanent destruction of the encryption key — is the approved deletion method for cloud-hosted Customer Data, including Special Category Data. The procedure for cryptographic erasure is set out in Section 7.1 of the CDEP1. Following cryptographic erasure, data encrypted under the destroyed key is irrecoverable.

For Special Category Data, cryptographic erasure must be confirmed by the Data Protection Officer in accordance with Section 6.5 of the CDEP1 and Section 13.1 of the MDPA. DPO sign-off is required before the Stage 1 (primary deletion) and Stage 2 (post-backup-purge) deletion confirmations are issued to the Customer.

7. Physical Security

8. Premises

Skylark Control operates a remote-first working model. All critical infrastructure for the Skylark SaaS Platform is cloud-hosted in a DigitalOcean Virtual Private Cloud (VPC) as described in Section 3.1. The Company does not maintain server rooms, on-premise server infrastructure, or any internal corporate network — staff connect to platform and business systems directly over the public internet using authenticated cloud services. Customer Data is not stored or processed on staff devices or office equipment outside of authenticated access to the Platform.

Skylark Control maintains a hot-desking office which is used by staff on a flexible, non-allocated basis. The office is secured by key-card access control at the building entrance and at the entrance to individual rooms within the premises. CCTV is installed at the building entrance. A member of staff is present at the front desk during working hours to receive visitors and verify identity. Access is restricted to authorised staff and approved visitors. Visitors are signed in at the front desk and accompanied by a member of staff at all times.

2. Clean Desk and Screen Lock

Staff are required to maintain a clear desk when away from their workstation and must not leave sensitive information visible or accessible. Screen lock activates automatically after 15 minutes of inactivity and requires re-authentication to unlock.

3. Device Management

All staff devices used to access Skylark systems or Customer Data are enrolled in mobile device management (MDM). The following controls are enforced through MDM:

• Full-disk encryption is enabled on all devices
• Remote wipe capability is active for all enrolled devices
• Endpoint protection (antivirus/EDR) is installed and maintained up to date
• Operating system and application updates are applied within 7 days of release for critical patches

Physical devices at end of life are disposed of in accordance with Section 7.2 of the CDEP1, which requires secure destruction and a destruction certificate.

8. Business Continuity and Disaster Recovery

9. Service Availability

The Skylark Platform is operated to a target availability of 99.9%, measured monthly across the production environment. The availability target excludes:

• Planned maintenance, including the standing weekly maintenance window (Thursdays 22:00–00:00 UK time) and user-impacting changes notified in accordance with the Support Services Policy
• Unscheduled emergency maintenance, where Skylark Control will use reasonable endeavours to provide at least 6 working hours' notice in advance
• Service degradation caused by Customer-side network connectivity, third-party services outside Skylark Control's control, or factors covered by force majeure

The Platform is configured for high availability, with hot-standby instances providing automated failover. Failover is triggered automatically by health-check failures and does not require manual intervention to restore service.

Where a catastrophic failure has caused the high-availability layer itself to be unavailable and full recovery from backup is required, the recovery time is governed by the RTO in Section 8.2. Such events fall outside the availability target by their nature, as the HA infrastructure that underpins the 99.9% commitment has itself been compromised.

2. Recovery Objectives

3. Backup

Customer Data is backed up in accordance with the following schedule:

Backups are encrypted using the same standards as primary data. Backup integrity is verified automatically on completion; failures generate an alert to the operations team.

Customer Data in backup systems is purged within 90 days of the primary deletion event, in accordance with Section 6.5 of the CDEP1 and the MDPA.

Backup retention windows for the schedules above must not exceed the 90-day deletion-event purge commitment in MDPA §13.2 and CDEP1 §6.5 without prior DPO authorisation and a documented manual purge process. Where any backup type is configured with a retention window longer than 90 days, the rationale, authorising DPO, and the manual purge procedure to satisfy the 90-day commitment must be recorded in the Information Asset Register.

4. Disaster Recovery Testing

The disaster recovery plan is tested no less than every 6 months. Testing includes a simulated failover to the backup environment and verification that RTO and RPO targets can be met. Test results are documented and reviewed by senior management. Findings are remediated before the next scheduled test.

9. Internal Incident Response

This section covers the internal process for detecting and managing security incidents. Obligations to notify customers of confirmed Personal Data Breaches are governed by Section 10 of the MDPA.

1. Detection and Triage

Security incidents may be identified through:

• Automated monitoring and alerting (infrastructure, application, and access logs)
• Reports from staff, customers, or third parties
• Findings from penetration testing, vendor security advisories, or software composition analysis (SCA)
• Notification from sub-processors (including DigitalOcean as primary host and AWS as backup-storage provider)

All potential security incidents are logged in Plane, the Company's incident management and tracking system, immediately upon identification. The on-call engineer performs an initial triage within 2 hours of the alert being raised to determine severity.

Audit, access, network, key management, and incident logs generated under this Policy are retained in accordance with the Retention Register set out in Section 12 of the CDEP1 (currently 5 years for Platform audit and access logs). Logs supporting an active investigation, legal hold, or unresolved incident are retained beyond the standard period until the matter is closed and DPO sign-off to release the hold has been obtained.

2. Severity Classification

3. Escalation

Critical and High severity incidents are escalated immediately to the Data Protection Officer. Where a Critical incident involves Customer Data, the DPO determines whether a Personal Data Breach notification obligation is triggered under UK GDPR Article 33. The 72-hour ICO notification clock starts from the point the Company becomes aware of a breach.

The Company's MDPA obligation to notify customers of a confirmed Personal Data Breach (by close of business on the Business Day following confirmation of the breach) runs concurrently with the ICO 72-hour notification obligation. Customer notification is set well in advance of the ICO deadline to allow customers sufficient time to prepare their own Art. 33 notification where required.

Personal Data Breach Notification Assessment

When a Critical or High severity incident involves Customer Data, the DPO assesses whether a notification obligation has been triggered. Two thresholds apply under UK GDPR:

Article 33 — notify the ICO within 72 hours where the breach is likely to result in a risk to the rights and freedoms of individuals. The DPO should treat notification as required unless the breach clearly does not meet the threshold. Factors indicating risk include:

• Special category data involved, including medical fitness certificates
• Financial data, credentials, or authentication tokens exposed
• Data disclosed to unknown or unauthorised parties
• Multiple individuals affected
• Data subjects are in safety-critical roles

Notification is not required only where the breach is unlikely to result in any risk — for example, where encrypted data has been rendered inaccessible to the recipient, or data has been accidentally sent to a known and trusted party who has confirmed immediate deletion without onward disclosure.

Article 34 — notify affected data subjects without undue delay where the breach is likely to result in a high risk. The DPO should apply this threshold in addition to Article 33 where:

• Concrete adverse consequences are likely, including financial loss, discrimination, physical harm, reputational damage, or loss of control over personal data
• Data subjects cannot take protective action without being informed
• Special category data is confirmed as having been accessed by unauthorised parties

The DPO records the notification decision and supporting rationale in Plane regardless of the outcome, including where the decision is that notification is not required. This record forms part of the Company's accountability documentation under UK GDPR Article 5(2).

4. Containment and Recovery

The incident response team will take appropriate steps to contain the incident, preserve evidence, and restore normal service in accordance with the documented incident response runbooks. The priority order is: contain, assess impact, recover, then investigate root cause.

5. Post-Incident Review

All Critical and High severity incidents are subject to a post-incident review within 5 working days of closure. The review documents the timeline, root cause, impact, and remediation actions. Findings are reviewed by the Information Security Officer and senior management and tracked to completion. Where an incident reveals a systemic control weakness, the risk register is updated.

10. Staff Security

11. Security Awareness Training

All staff complete mandatory security awareness training upon joining and annually thereafter. Training covers:

• Recognising and reporting phishing and social engineering
• Acceptable use of company systems and devices
• Password and authentication hygiene
• Physical security and clean desk requirements
• Incident reporting obligations

Staff whose role involves access to production systems or Customer Data complete additional role-specific security training before access is granted. Completion of training is recorded and is a prerequisite for access.

The annual security awareness training is delivered by Instil Software, Skylark Control's security partner. Training is delivered through a combination of:

• Structured UK GDPR and information security workshops at induction and on an annual refresh cycle
• Assessment tests on completion of each training module, with a minimum pass mark required for sign-off
• Coaching, mentoring, and 1:1 support sessions for staff in roles with elevated data protection responsibilities
• Quick-reference scripts, checklists, and reminder aids accessible from the staff intranet for common scenarios such as handling a data subject rights request or a suspected breach

Staff with data protection responsibilities complete the enhanced data protection training specified in Section 4.2 of the CDEP1 and Section 8 of the APD, in addition to security awareness training.

2. Acceptable Use

All staff are bound by the Skylark Control Acceptable Use Policy as a condition of employment. The Acceptable Use Policy governs the use of company systems, devices, and data, including restrictions on personal use, data transfer, and remote working.

11. Penetration Testing and External Assurance

12. Annual Penetration Testing

An independent penetration test of the Skylark Platform is conducted no less than annually by Instil Software (https://instil.co). Instil Software hold multiple National Cyber Security Centre (NCSC) certifications, are Cyber Scheme Certified testers, and are independently certified to ISO 27001 (information security management) and ISO 9001 (quality management). The scope covers:

• External network and application penetration testing of the production environment
• DigitalOcean VPC interior testing — lateral-movement risk between platform services within the production VPC
• API security testing
• Mobile application penetration testing covering the Skylark mobile app for iOS and Android

A penetration test is also triggered following any significant change to the platform architecture or following a Critical severity incident involving potential system compromise.

2. Remediation

Findings from penetration testing are triaged by severity in accordance with Section 3.3. Critical and high findings are remediated before the test report is shared with customers. A remediation summary is available to customers on request under the audit provisions of the MDPA.

3. ISO 27001 Surveillance Audits

Annual surveillance audits against ISO 27001 are conducted by the certifying body. Findings from surveillance audits are reviewed by senior management and remediated in accordance with the ISMS corrective action process.

4. Customer Audit Rights

Customer audit rights are governed by Section 14 of the MDPA. The standard assurance package — current penetration test summary, ISO 27001 certificate, and Cyber Essentials Plus certificate — is available to customers on written request. Direct audits are available in accordance with the conditions set out in Section 14.2 of the MDPA.

12. Supplier Security

13. Sub-processor Vetting

Before engaging any new sub-processor to process Customer Data, Skylark Control carries out a security due diligence assessment covering:

• The sub-processor's security certifications and audit reports (SOC 2, ISO 27001, or equivalent)
• Data processing agreement review confirming obligations equivalent to those in the MDPA
• International transfer mechanism (where applicable)
• Incident notification obligations

The assessment is documented and reviewed by the DPO and Information Security Officer before the sub-processor is approved.

2. Ongoing Sub-processor Review

Sub-processors handling Customer Data are reviewed no less than annually. The review confirms that:

• The sub-processor's security certifications remain current
• The data processing agreement remains adequate
• No material changes to the sub-processor's processing activities have occurred without notification

The Sub-processor Register is updated to reflect the outcome of each annual review.

3. Sub-processor Contractual Requirements

All sub-processors processing Customer Data are bound by a data processing agreement that requires:

• Processing only on Skylark Control's documented instructions
• Implementation of appropriate technical and organisational measures
• Notification of any sub-processor security incident affecting Customer Data within 24 hours
• Deletion or return of Customer Data on termination
• Submission to audit in accordance with the MDPA

13. Security Risk Management

14. Risk Assessment

The ISMS risk assessment is conducted no less than annually and is updated following any significant change to the platform, infrastructure, or threat landscape. Risks are identified, assessed, and tracked in the Skylark Control Risk Register, maintained on Plane. The assessment considers:

• Threats to the confidentiality, integrity, and availability of Customer Data and platform systems
• Likelihood and impact of each identified risk
• Existing controls and their effectiveness
• Residual risk and treatment decisions

2. Risk Register

The risk register is maintained by the Information Security Officer and reviewed by senior management quarterly. Risks above the defined risk appetite threshold are subject to a documented treatment plan with an assigned owner and target remediation date.

3. Data Protection Impact Assessments

Where a new processing activity, system change, or feature introduction is likely to result in a high risk to individuals' rights and freedoms, a Data Protection Impact Assessment (DPIA) is conducted before processing commences, in accordance with UK GDPR Article 35. The DPIA process is owned by the Data Protection Officer. Security findings from the DPIA are recorded in the risk register.

14. Monitoring and Review of this Policy

This Policy is reviewed no less than annually by the Information Security Officer and the Data Protection Officer. Review is also triggered by:

• A material change to the Skylark Platform architecture or infrastructure
• A Critical severity security incident
• A finding from penetration testing or an ISO 27001 surveillance audit that requires a policy update
• A change to applicable law or regulatory guidance

Where this Policy is updated in a way that materially affects customers' rights or obligations under the MDPA, notice is provided in accordance with Section 16 of the MDPA.

1. ISMS Objectives

The standing objectives of the ISMS are reviewed and updated no less than annually by the Information Security Officer and reported to senior management:

• Retain ISO 27001 certification through continued conformity to all ISMS activities and successful completion of annual NQA surveillance audits
• Maintain and continually improve documented operating procedures for all key platform and business processes
• Achieve zero Severity 1 security incidents caused by internal process failures

2. Continual Improvement

The Company is committed to the continual improvement of the ISMS. Documented procedures are maintained to ensure that nonconformities are identified and that corrective and preventive actions are introduced to eliminate root causes and improve the effectiveness of the ISMS. Corrective actions are tracked to completion and their effectiveness is reviewed by the Information Security Officer.

Document owner: Information Security Officer and Karol Harkin (Data Protection Officer)
Published at: https://admin.skylarkcontrol.com/legal/security-policy.html