--- title: "Security at Visor: ISO/IEC 27001:2022, GDPR and subprocessors" canonical: https://www.visor.ai/security/ lang: en --- # Security at Visor Visor is certified to ISO/IEC 27001:2022, and all ten of our subprocessors are in the EU. The certificate and our security policies are available on request. Security contact [securityoffice@visor.ai](mailto:securityoffice@visor.ai) How we handle personal data [Privacy Policy](https://www.visor.ai/privacy-policy/) - **ISO/IEC 27001:2022** Certified. The international standard for information security management. - **GDPR** Visor processes personal data under the General Data Protection Regulation. ## How we protect data Visor applies 87 security controls, in four groups. The ones buyers ask about first come before the full list. **87** security controls - **33** Organisational - **34** Technological - **14** Physical - **6** Personnel ### What buyers ask about first Encryption at rest and in transit Data on AWS is encrypted at rest and in transit, under rules for cryptography and key management. Control: Use of cryptography Multi-factor authentication Secure authentication confirms user identities, with multi-factor authentication. Control: Secure authentication Tested backups Backups of information, software and systems are made and tested regularly. Control: Information backup Separate environments Development, test and production are kept apart, and testing does not happen in production. Control: Separation of development, test and production environments Penetration tests Applications and code are security-tested during development, including penetration tests. Control: Security testing in development and acceptance Background screening Background checks on candidates and employees, within legal and ethical standards. Control: Screening Incident response and lessons learned Incidents follow set procedures, and lessons from past incidents feed into response plans and training. Controls: Response to and Learning from information security incidents Internal audits and management reviews Annual internal audits, and management reviews at set intervals or after significant changes. Control: Independent review of information security Business continuity and disaster recovery Business continuity and disaster recovery plans, and a continuity plan for systems that is tested regularly. Controls: ICT readiness for business continuity, Information security during disruption Logging and monitoring Activity and security events are logged and analysed, and systems are monitored for unusual activity. Controls: Logging, Monitoring activities Restricted access and access reviews Access goes only to authorised people for specific tasks, with regular access reviews. Controls: Access control, Privileged access rights ### All 87 controls Organisational controls 33 Acceptable use of information and other associated assets Rules for using and handling company information and assets are set and communicated to everyone. Access control Only authorised people reach specific information and resources, with regular access reviews and network access for authorised staff only. Access rights Access to tools and information is granted, adjusted and removed as needed. Information security in supplier agreements Supplier agreements set out security requirements and responsibilities. Assessment and decision on information security events Security events are rated by severity, escalated when needed and recorded for analysis. Authentication information Passwords and other login details are managed and protected. Classification of information Data is classified and handled by its importance and sensitivity, under a written policy. Collection of evidence Evidence from security events is identified, collected and preserved for possible legal or disciplinary action. Compliance with policies, rules and standards for information security Managers and information owners check compliance regularly, and nonconformities are tracked and resolved. Contact with authorities Who contacts the authorities, when, and how incidents are reported on time, is defined. Contact with special interest groups Visor follows security news and forums on threats, good practice and new vulnerabilities. ICT readiness for business continuity A plan keeps systems and information available during disruptions, and it is tested regularly. Identity management User identities and accounts are managed through their whole life cycle, one account per person. Independent review of information security Annual internal audits, and management reviews at set intervals or after significant changes. Information security during disruption Security measures for disruptions are documented in the business continuity and disaster recovery plans. Information security for use of cloud services Rules for choosing, managing and leaving cloud services, with defined roles. Information security in project management Projects address security risks, including supplier risk through compliance checks. Information security in supplier relationships A supplier list is kept, and suppliers who handle company data must meet security standards. Managing information security in the ICT supply chain Suppliers of ICT products and services get security requirements, and their compliance is monitored. Information security incident management planning and preparation Roles, responsibilities and procedures for incidents are defined, and every employee can read them. Information security roles and responsibilities Security tasks are assigned, and each person knows their responsibilities. Information transfer Data sent inside or outside Visor follows secure transfer rules. Intellectual property rights Only licensed software is used, and copyright law is followed. Labelling of information Information is labelled with its security level so people handle it correctly. Learning from information security incidents Lessons from past incidents feed into defences, response plans and staff training. Legal, statutory, regulatory and contractual requirements Legal, regulatory and contractual security requirements, such as DPAs, NDAs and SLAs, are identified and recorded. Monitoring, review and change management of supplier services Suppliers are reviewed by risk, with an annual review for high-risk suppliers. Privacy and protection of personal data Personal data is protected under law and contract, and applications that process it are part of supplier and access reviews. Protection of records Records are stored securely with least-privilege access, under written document control procedures. Response to information security incidents Incidents are handled with set procedures, evidence collection and clear communication. Return of assets People who leave return company assets through an offboarding checklist. Segregation of duties Tasks are split so that no single person holds too much access or power. Threat intelligence Information on threats is gathered and analysed to inform decisions. Technological controls 34 Access to source code Write access to source code is limited to the people who need it. Application security requirements Security requirements, such as authentication and data protection, are defined when building or buying applications. Capacity management Resource use is monitored and adjusted as needed. Change management System changes follow set procedures, with impact assessment, testing and records. Clock synchronisation System clocks are synchronised with approved time sources, so events are logged accurately. Configuration management Hardware, software and networks follow standard secure configurations that are recorded and monitored. Data leakage prevention Tools detect and stop data from being shared or exposed without authorisation. Data masking Sensitive data such as personal data is masked, pseudonymised or anonymised to limit exposure. Information access restriction Access to information and assets is restricted under policy. Information backup Backups of information, software and systems are made and tested regularly, under a backup policy. Information deletion Information no longer needed is deleted with approved methods, and each deletion is recorded. Installation of software on operational systems Only trained, authorised administrators install software on operational systems. Logging System activity and security events are logged, and logs are protected from change and analysed for unusual activity. Management of technical vulnerabilities Technical vulnerabilities are identified, assessed, fixed and documented. Monitoring activities Networks, systems and applications are monitored for unusual activity, with alerts. Networks security Networks and connections are protected with firewalls, monitoring and authentication. Outsourced development Outsourced development has set security requirements and is monitored. Privileged access rights Privileged access goes only to authorised users for specific tasks, and is reviewed regularly. Protection against malware Malware detection, awareness training and access controls protect systems. Protection of information systems during audit testing Audit tests are agreed with management, with limited access and monitoring. Redundancy of information processing facilities Redundant systems keep processing running if a component fails. Secure authentication Secure authentication methods confirm user identities, with multi-factor authentication. Secure coding Secure coding principles apply, such as no hard-coded passwords, encryption and up-to-date libraries. Secure development life cycle Security is part of design, coding guidelines, testing and developer training. Secure system architecture and engineering principles Systems are designed to written secure engineering principles. Security of network services Network services have security measures, usage rules and provider monitoring. Security testing in development and acceptance Applications and code are security-tested during development, including penetration tests. Segregation of networks The network is divided into zones with their own access rules and firewalls. Separation of development, test and production environments Development, test and production are kept apart, and testing does not happen in production. Test information Changes to systems are assessed, tested, including security testing, and recorded. Use of cryptography Rules for cryptography, including key management. Encryption is considered for data at rest and in transit. Use of privileged utility programs Only trusted users can run utility programs that override controls, and each use is logged. User endpoint devices Information on user devices is protected by policy, access control, encryption and training, personal devices included. Web filtering Harmful websites are blocked by IP and domain, and staff learn safe browsing. Physical controls 14 Cabling security Power and data cables are protected against interference and damage. Clear desk and clear screen Clear desk and screen lock rules protect information left unattended. Equipment maintenance Equipment is maintained to supplier guidance, and faults are recorded. Equipment siting and protection Equipment is placed and protected against unauthorised access and damage. Physical entry Only approved people can enter sensitive areas. Physical security monitoring The premises are under continuous surveillance, with alarms. Physical security perimeters Walls, doors and windows of sensitive areas are secured and monitored. Protecting against physical and environmental threats Measures protect against natural disasters and other physical threats. Secure disposal or re-use of equipment Data is removed from equipment before it is disposed of or reused. Securing offices, rooms and facilities Spaces that handle confidential information are secured and kept discreet. Security of assets off-premises Laptops and phones used off-site are protected against damage and unauthorised access. Storage media Storage media are encrypted and disposed of securely, under clear rules. Supporting utilities Operations are protected against power failures and other utility outages. Working in secure areas Work in secure areas is supervised, with access control and limits on personal devices. Personnel controls 6 Confidentiality or non-disclosure agreements Staff and relevant parties sign confidentiality agreements, which are reviewed regularly. Information security event reporting Staff have a quick, simple way to report possible security issues. Remote working Rules and security measures cover working with information outside the office. Responsibilities after termination or change of employment Security obligations continue after someone leaves or changes role, and they are told so. Screening Background checks on candidates and employees, within legal and ethical standards. Terms and conditions of employment Employment contracts set out the security responsibilities of both sides. ## Request our security documents These documents are available on request through our trust center, hosted by Secfix. Certifications - ISO/IEC 27001:2022 Certificate Available on request Policies - POL-00 ISMS List of documents Available on request - POL-01 Scope of the ISMS Available on request - POL-02 Information Security Management System Available on request - POL-04 Information Security & Acceptable Use Available on request [Request the documents in the trust center](https://app.secfix.com/trust/visor/a8d96edab05a4c549f006847c5ac73e3) Opens the trust center in a new tab. ## Where data lives, who processes it Ten subprocessors handle data for Visor. All ten are in the EU. Provider Purpose Data processed Region ![Google Workspace](https://www.visor.ai/assets/vendors/sourced-google-workspace.svg) Business email, document storage, collaboration and calendars Email addresses, names, contact details, shared documents and files, log data **EU** ![AWS](https://www.visor.ai/_astro/sourced-aws.cCmIak93_ZG4JOt.webp) Cloud infrastructure, hosting and databases that run the platform and store data Customer data, including personal data, and log data (device information) **EU** Azure Cloud services; large language model provider Prompts, generated outputs and related metadata **EU** Vonage Communication APIs and telephony for voice and messaging Phone numbers, contact names, call logs and message metadata **EU** ![Atlassian](https://www.visor.ai/assets/vendors/sourced-atlassian.svg) Project management, issue tracking and support ticketing Email addresses, names, support ticket content and metadata **EU** ![Factorial](https://www.visor.ai/_astro/sourced-factorial.T4rlghN3_2mmbbh.webp) HR Visor employees' data only **EU** ![Google Cloud](https://www.visor.ai/assets/vendors/sourced-google-cloud.svg)Vertex AI Gemini large language models used by the AI agents to process conversations Prompts, generated outputs and related metadata **EU** Vertex AI region europe-west8 ![Deepgram](https://www.visor.ai/assets/vendors/sourced-deepgram.svg) Speech-to-text for calls handled by the Voice AI Agent Call audio and transcripts **EU** Dedicated EU endpoint ![AssemblyAI](https://www.visor.ai/assets/vendors/sourced-assemblyai.svg) Speech-to-text for calls handled by the Voice AI Agent Call audio and transcripts **EU** Dedicated EU endpoint ![ElevenLabs](https://www.visor.ai/assets/vendors/sourced-elevenlabs.svg) Text-to-speech Text to be spoken and the generated audio **EU** EU data residency ## AI and your data Every AI provider in the voice and chat path runs in the EU. Each one handles customer data under its own terms. Azure EU Prompts, generated outputs and related metadata may be processed. Microsoft does not use customer data to train or improve models. ![Google Cloud](https://www.visor.ai/assets/vendors/sourced-google-cloud.svg)Vertex AI EU, region europe-west8 Google does not use customer data to train or fine-tune models without the customer's permission. Inputs may be cached in memory for a limited period to reduce latency, and prompts may be logged for abuse monitoring, as Google Cloud's terms set out. ![Deepgram](https://www.visor.ai/assets/vendors/sourced-deepgram.svg) Dedicated EU endpoint Visor's requests are excluded from Deepgram's Model Improvement Program, so customer audio is not used to train Deepgram models. Audio is kept only for the time needed to process each request. ![AssemblyAI](https://www.visor.ai/assets/vendors/sourced-assemblyai.svg) Dedicated EU endpoint Visor's account is opted out of AssemblyAI's model improvement program, so customer data is not used to train its models or for benchmarking. ![ElevenLabs](https://www.visor.ai/assets/vendors/sourced-elevenlabs.svg) EU data residency Used under an enterprise agreement with EU data residency and Zero Retention Mode, so content is not kept on ElevenLabs' servers after processing and is not used to train its models. ## Frequently asked questions Is Visor ISO 27001 certified? Yes. Visor is certified to ISO/IEC 27001:2022. You can [request the certificate](https://www.visor.ai/security/#documents) through our trust center. Is Visor GDPR compliant? Visor processes personal data under the GDPR, and all ten of its subprocessors are in the EU. [The full list](https://www.visor.ai/security/#subprocessors) shows what each one processes. Where is customer data hosted? On AWS, in the EU. The platform's hosting, infrastructure and databases run there. [See every subprocessor and its region.](https://www.visor.ai/security/#subprocessors) Is customer data used to train AI models? Each AI provider follows its own terms. Azure, Deepgram, AssemblyAI and ElevenLabs do not use it to train their models. Vertex AI does not train or fine-tune models on it without permission. [Read each provider's terms.](https://www.visor.ai/security/#ai) How do I request the certificate and policies? Request them through our trust center, hosted by Secfix. [See the five documents.](https://www.visor.ai/security/#documents) For any other security question, write to [securityoffice@visor.ai](mailto:securityoffice@visor.ai).