---
title: Security and Compliance | ISO 27001 Whistleblowing Software | Speak Out Safe
description: "How Speak Out Safe protects whistleblowing and safeguarding reports: ISO/IEC 27001:2022, Cyber Essentials, encryption, MFA, UK and EU GDPR and a full audit trail."
---

[![Speak Out Safe logo](https://speakoutsafe.uk/hubfs/website-2026/sos-logo-white.png)](https://speakoutsafe.uk/?hsLang=en)

[Platform](https://speakoutsafe.uk/product?hsLang=en)[Who it's for](https://speakoutsafe.uk/#sectors)[Security](https://speakoutsafe.uk/security?hsLang=en)[Pricing](https://speakoutsafe.uk/pricing?hsLang=en)[Insights](https://speakoutsafe.uk/blog?hsLang=en)[About](https://speakoutsafe.uk/about-us?hsLang=en)[Contact](https://speakoutsafe.uk/contact-us?hsLang=en)

[Log in](https://portal.speakoutsafe.uk/login)[Book a demo](https://meetings-eu1.hubspot.com/marius-van-aswegen/book-a-call)

Security and compliance

# Built by people who audit security for a living.

The reports people trust us with are among the most sensitive information an organisation holds. Here is how we protect them.

[Book a demo](https://meetings-eu1.hubspot.com/marius-van-aswegen/book-a-call)[Request security information](mailto:hello@speakoutsafe.uk?subject=Security%20due%20diligence)

![ISO/IEC 27001:2022 certified by SANCERT, Cyber Essentials certified, and Government Commercial Agency Supplier](https://speakoutsafe.uk/hubfs/website-2026/sos-trust-badges.png)ISO/IEC 27001:2022 certified by SANCERT · Cyber Essentials · Government Commercial Agency Supplier

How we protect reports

## Security in every layer.

### Certified security management

The platform runs under an ISO/IEC 27001:2022 information security management system, certified by SANCERT, and Speak Out Safe is Cyber Essentials certified.

### Encrypted, with data where you need it

Hosted on Microsoft Azure, with data held in your chosen region and encrypted both at rest and in transit.

### Strong access control

Case handlers sign in with multi-factor authentication, and role-based permissions mean people only see the cases they are meant to.

### Nothing sensitive by email

Report details never travel by email. Alerts contain no report content; handlers log in to the secure platform to read it.

### A dedicated portal for each customer

Each organisation has its own portal, so reports are held separately and seen only by the people you choose.

### A full audit trail

Every action on a case is recorded, from assignment and notes to closure codes, so you can show exactly how a concern was handled.

Privacy and anonymity

## Designed to protect the person speaking up.

Anonymity only works if the technology supports it. Reporters can choose not to give their name and can still answer follow-up questions, so organisations can investigate without ever learning who raised the concern.

- Anonymous reporting with secure two-way messaging
- UK and EU GDPR, with you as controller and Speak Out Safe as processor
- A data processing agreement as standard
- Reports seen only by the case handlers you choose
- Supports safeguarding information sharing with a clear audit trail

FAQs

## Security questions.

Is Speak Out Safe ISO 27001 certified?

The platform runs under an ISO/IEC 27001:2022 information security management system certified by SANCERT. Speak Out Safe is also Cyber Essentials certified.

Where is our data stored?

The platform is hosted on Microsoft Azure, with data held in your chosen region so your data sovereignty is maintained. Data is encrypted at rest and in transit.

Who is the data controller?

You are the data controller and Speak Out Safe is the processor. A data processing agreement is provided as standard.

Are reports ever sent by email?

No. Report details never travel by email. Alerts tell case handlers that something needs attention, and they log in to the secure platform to read it.

Can you complete our security questionnaire?

Yes. We regularly support security due diligence and supplier assessments. Email hello@speakoutsafe.uk and we will help.

Read our [Privacy Policy](https://speakoutsafe.uk/privacypolicy?hsLang=en) and [Data Processing Agreement](https://speakoutsafe.uk/dataprocessingagreement?hsLang=en).

## Completing a supplier security review?

We are happy to answer security questionnaires and due diligence requests.

[Email us](mailto:hello@speakoutsafe.uk?subject=Security%20due%20diligence)[Book a demo](https://meetings-eu1.hubspot.com/marius-van-aswegen/book-a-call)

![Speak Out Safe logo](https://speakoutsafe.uk/hubfs/website-2026/sos-logo-white.png)

Speak Out Safe Ltd, 3 Nursery Gardens, Morpeth, Northumberland, NE61 6FP.  
Company number 15241830. VAT number 491 0374 94.

[hello@speakoutsafe.uk](mailto:hello@speakoutsafe.uk)

**Product**[Platform](https://speakoutsafe.uk/product?hsLang=en)[Plans](https://speakoutsafe.uk/pricing?hsLang=en)[About](https://speakoutsafe.uk/about-us?hsLang=en)[Security](https://speakoutsafe.uk/security?hsLang=en)[Insights](https://speakoutsafe.uk/blog?hsLang=en)[Log in](https://portal.speakoutsafe.uk/login)

**Resources**[Insights](https://speakoutsafe.uk/blog?hsLang=en)[Awareness calendar](https://speakoutsafe.uk/awareness-calendar?hsLang=en)[Legislation guide](https://speakoutsafe.uk/uk-safeguarding-whistleblowing-legislation?hsLang=en)

**Legal**[Terms and Conditions](https://speakoutsafe.uk/tsandcs?hsLang=en)[Privacy Policy](https://speakoutsafe.uk/privacypolicy?hsLang=en)[Cookie Policy](https://speakoutsafe.uk/cookiepolicy?hsLang=en)[Data Processing Agreement](https://speakoutsafe.uk/dataprocessingagreement?hsLang=en)Cookie settings

![ISO/IEC 27001:2022 certified by SANCERT, Cyber Essentials certified, and Government Commercial Agency Supplier](https://speakoutsafe.uk/hubfs/website-2026/sos-trust-badges.png)

**GDPR compliant**UK and EU data protection

© 2026 Speak Out Safe Ltd. All rights reserved.

```json
{
  "@context" : "https://schema.org",
  "@type" : "FAQPage",
  "mainEntity" : [ {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "The platform runs under an ISO/IEC 27001:2022 information security management system certified by SANCERT. Speak Out Safe is also Cyber Essentials certified."
    },
    "name" : "Is Speak Out Safe ISO 27001 certified?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "The platform is hosted on Microsoft Azure, with data held in your chosen region so your data sovereignty is maintained. Data is encrypted at rest and in transit."
    },
    "name" : "Where is our data stored?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "You are the data controller and Speak Out Safe is the processor. A data processing agreement is provided as standard."
    },
    "name" : "Who is the data controller?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "No. Report details never travel by email. Alerts tell case handlers that something needs attention, and they log in to the secure platform to read it."
    },
    "name" : "Are reports ever sent by email?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "Yes. We regularly support security due diligence and supplier assessments. Email hello@speakoutsafe.uk and we will help."
    },
    "name" : "Can you complete our security questionnaire?"
  } ]
}
```