Trust & Security
The policies behind the platform, for the security and compliance teams reviewing us.
Last updated October 21, 2026
Policies
How we protect your data, keep the service running and do business responsibly.
Security
Information Security Policy
This Information Security Policy establishes the governance, principles, and minimum control requirements for protecting Subcontext Ltd ("Subcontext") information assets.
Version 1 · Updated October 21, 2026 Read the policyIncident Response Plan
This plan establishes procedures for detecting, responding to, and recovering from security incidents affecting Subcontext systems, data, or services. Its aims are to limit harm...
Version 1 · Updated October 21, 2026 Read the policyVulnerability Management Policy
This policy establishes Subcontext's approach to identifying, assessing, and remediating security vulnerabilities. It makes sure weaknesses in our code, dependencies, container...
Version 1 · Updated October 21, 2026 Read the policyAccess Control Policy
This policy establishes access control requirements for Subcontext systems and data. It sets out who may access what, how that access is granted, authenticated, reviewed and...
Version 1 · Updated October 21, 2026 Read the policyChange Management Policy
This policy establishes the process for managing changes to the Subcontext platform, infrastructure, and configuration. Its aim is to make sure every change to production is...
Version 1 · Updated October 21, 2026 Read the policyVulnerability Disclosure Policy
We welcome reports from security researchers who find vulnerabilities in Subcontext. This policy explains what is in scope, how to report a vulnerability, and what you can...
Version 1 · Updated October 21, 2026 Read the policySecure Development Policy
This policy sets out how Subcontext designs, builds, tests and releases software so that security is built in from the start. It applies the principle that security problems are...
Version 1 · Updated October 21, 2026 Read the policyEncryption & Key Management Policy
This policy sets out how data is encrypted in transit and at rest, and how encryption keys and secrets are managed. Encryption protects data if it is intercepted on the network...
Version 1 · Updated October 21, 2026 Read the policyLogging & Monitoring Policy
This policy sets out what Subcontext logs, how long logs are kept, how they are protected and how they are monitored. Good logging lets Subcontext detect and investigate...
Version 1 · Updated October 21, 2026 Read the policyStaff Security Policy
This policy sets out the security responsibilities of everyone who works for or with Subcontext, from joining to leaving.
Version 1 · Updated October 21, 2026 Read the policyEnterprise Order Form
Fixed-term and negotiated plans are agreed on an Order Form under our Terms of Service. Here is the template we use.
Questions from your security or procurement team?
We're happy to answer questionnaires and talk through any of these policies.