Trust and procurement
The information a supplier review normally asks for, in one place. If your process needs something that is not here, email hello@tektonsystems.co.uk and we will complete your questionnaire directly.
The company
- Trading name
- TEKWROUGHT
- VAT
- Not VAT registered. Our invoices carry no VAT.
Assurance
Our security policies are written against ISO/IEC 27001:2022 Annex A.
TEKWROUGHT does not itself hold ISO 27001 or SOC 2 today. The providers that run our production systems do, and their audit reports are available on request.
| Provider | Runs | Independent assurance |
|---|---|---|
| Vercel | Hosting and edge network | SOC 2 Type II · ISO/IEC 27001 |
| Neon | PostgreSQL database | SOC 2 Type II · ISO/IEC 27001 |
| GitHub | Source control | SOC 2 Type II · ISO/IEC 27001 |
| Stripe | Payments | PCI DSS Level 1 · SOC 2 Type II |
| Resend | Transactional email | SOC 2 Type II |
- Multi-factor authentication on every administrative account, with named access only, reviewed quarterly.
- Card payments are taken through Stripe's hosted checkout. We never see or store card numbers.
- Daily database backups with point-in-time recovery, held in the London region.
Who does the work
Every engagement is led by TEKWROUGHT’s principal engineer, who is accountable for it from survey to handover. Specialist associates join where the work requires them, engaged under written contracts that include confidentiality and assignment of intellectual property.
Data handling
- Client data is stored in the UK (London region) wherever our providers allow it, and encrypted in transit (TLS 1.2 or higher) and at rest.
- Access to your systems is read-only unless agreed in writing, issued per person, logged, and withdrawn at the end of the engagement.
- Logs you share are reduced to aggregates and query structures with literal values removed. Raw files are not retained.
- Personal data is processed only under a UK GDPR Article 28 data processing agreement, signed before work starts.
- Full detail is on our security page.
Sub-processors
We give clients 14 days' notice of any change.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting for this site and our client cockpit (London region) | UK / EU, US parent |
| Neon (Databricks) | Managed PostgreSQL database (London region) | UK |
| Resend | Transactional email (enquiry notifications, reports) | EU (Ireland) |
| Stripe | Card payments and invoices | UK / EU |
| Sentry (Functional Software) | Error monitoring for this site (no personal content collected) | EU (Germany) |
| PostHog | Anonymous page-visit counts for this site (nothing stored on your device, no recordings) | EU (Germany) |
| Google (Places, PageSpeed) | Public business listings and public page-speed scores | Global |
| GitHub | Private source-code hosting for client builds | US |
Service levels
Standard targets. Your SLA schedule sets the hours and any service credits.
| Severity | Meaning | First response | Updates |
|---|---|---|---|
| P1 | Production down or data at risk | 1 hour, within the agreed window | Every 2 hours until resolved |
| P2 | Major function impaired, workaround exists | 4 working hours | Daily |
| P3 | Minor issue or change request | 1 working day | As agreed |
Continuity
- You own the code, infrastructure definitions and documentation, held in repositories you control.
- Every system is handed over with runbooks sufficient for another competent team to operate it.
- Credentials are held in your own accounts and password manager, never only in ours.
- Source-code escrow can be arranged for engagements that require it.
Documents on request
- Master services agreement and a sample statement of work, with acceptance criteria and an SLA schedule
- Data processing agreement (UK GDPR Article 28) with technical and organisational measures
- Information security policies covering access control, secure development, incident response and continuity
- Completed security questionnaires in SIG Lite, CAIQ or your own format
- Insurance certificates and company documents, as listed above
Starting a supplier review?
Tell us what your process requires and we will send the documents and answers you need.