Where does Vantage Point run, and where is data stored?
On Microsoft Azure, in your own region: UK data in the UK, EU data in the EU, US data in the US, and it does not leave that region. The application runs on Azure Container Apps; data sits in Azure Database for MySQL Flexible Server inside a private virtual network with no public endpoint; files in Azure Files; secrets in Azure Key Vault, read through managed identity. Azure’s own compliance programme (including ISO/IEC 27001 and SOC reports) covers the platform beneath us.
How is traffic protected on the way in?
Every request to the application arrives through Azure Front Door Premium with a web application firewall in prevention mode: the OWASP core rule set and bot management, TLS terminated on managed certificates, and origins that accept traffic only from the Front Door. Traffic between services inside the estate is encrypted too.
How is data encrypted?
Current TLS for all traffic, customer-facing and service-to-service. Managed encryption of the backing stores at rest (database, files, backups), keys managed by the platform. Secrets never live in code or images; they are Key Vault references injected at runtime.
How is data backed up, and how would it be restored?
The database takes automated backups with point-in-time restore inside the retention window, and file storage is snapshotted. Restore is rehearsed as part of release testing. Backups carry the same encryption as the live data and stay in the customer’s region.
How do you keep the service reliable?
The application and its queue workers run as separately scaled container apps behind a managed load balancer; a failed instance is replaced by the platform. Deployments are rolling revisions, so upgrades ship without planned downtime. Health probes gate every revision before it takes traffic.
What is monitored, and how would we hear about a problem?
Platform metrics, application health, WAF activity and database health are monitored continuously with alerting to the on-call engineer. Incidents that affect a customer are notified to that customer’s named contacts directly, with cause, impact and remediation set out in a post-incident note.
What is the uptime commitment?
The service-level commitment, and the credits behind it, are set out in the customer contract; the platform components beneath us each carry Microsoft’s own SLA. Ask for the current figures with the contract.
How is the software developed and released?
Every change is reviewed before merge and runs a gated pipeline: static analysis and type checks, the automated test suites, and a zero-tolerance dependency policy (every dependency audited on install, provenance signatures verified, no ignore lists). Nothing reaches production without those gates green.
Production access is limited to named engineers, reviewed and logged. Customer data is accessed only on the customer’s explicit request or for incident response.
Do you commission penetration testing?
Independent penetration testing is part of the release calendar; the latest summary letter is available under NDA alongside the SIG Lite and CAIQ questionnaires. Vulnerability reports from anyone are welcome through the vulnerability disclosure page.
Which standards apply to all of this?
Vantage Point is ISO/IEC 27001 certified for information security management. ISO 31000 informs our own risk register and the platform’s; ISO 37301 informs how obligations and controls connect. Certificate details are on the security page.
Questions: security@vantagepointgrc.com for security,privacy@vantagepointgrc.com for data protection.