Compliance and security
What we comply with, what we do not claim, and why
A page written to be checked rather than to reassure. It includes the list of what we do not claim, which is usually the more useful part.
What we claim and what we do not
What we comply with
- Compliance with the GDPR and with Lei n.º 58/2019
- A data processing agreement wherever we process on your behalf
- Standard contractual clauses and a transfer impact assessment where delivery leaves the EEA
- An EEA-only delivery model for categories that require it
- Alignment with SOC 2 at group level and with the LGPD for Brazilian delivery
- An audit right in the contract, including by a third party you appoint
What we do not claim
- ISO 27001 certification
- ISO 27701 certification
- Registration with the CNPD
- An issued SOC 2 audit report
Where we write aligned with, we mean aligned with rather than certified. If your organisation requires formal certification as a condition of contracting, say so in the first conversation.
What we do not claim
We hold no ISO 27001 or ISO 27701 certification and claim none anywhere on this site. We are not registered with the CNPD, and the reference to the CNPD on this page is to the applicable supervisory authority, not to any registration of ours.
Where we write aligned with, we mean aligned with rather than certified. That applies to SOC 2 at group level and to the LGPD for Brazilian delivery. A supplier who uses those two words interchangeably is relying on you not to notice.
If your organisation requires formal certification as a condition of contracting, say so in the first conversation. Better that we find out before the proposal than midway through an audit.
What we comply with and how you can check
A data processing agreement wherever we process personal data on your behalf, with purposes, categories and retention defined by you. Named, revocable and logged access. Data governance documentation available on request, including for audit by you or by a third party you appoint.
An audit right in the contract, rather than a promise to cooperate. For regulated sectors it is frequently the deciding point, and we would rather handle it as a clause than as goodwill.
The EEA-only model
For health data, for much of the public sector and for any case where residency inside the European Economic Area is a requirement, we operate exclusively in Portugal. There is no international transfer, so there are no standard contractual clauses and no transfer impact assessment to prepare.
It is the most expensive model we offer and we say so before the proposal. Where the data category requires it, we do not present the cheaper alternative as though it were comparable.
Frequently asked questions
Are you ISO 27001 certified?
No, and we claim it nowhere. If it is a condition of contracting, say so in the first conversation.
Are you registered with the CNPD?
No. The CNPD is the applicable supervisory authority in Portugal; it is not a registration we hold.
What does aligned with SOC 2 mean?
That we follow the controls at group level, without an issued SOC 2 audit report. Aligned is not certified.
Do you sign a GDPR processor agreement?
Yes, wherever we process personal data on your behalf.
Can we audit you?
Yes. The audit right sits in the contract, including audit by a third party you appoint.
How is access controlled?
Named access, limited to what the role requires, immediately revocable, with every access logged.
Is there an option to keep everything in the EEA?
There is, and it is what we recommend for health data and much of the public sector. It costs more and we say so before the proposal.
Who is the data protection officer?
The contact for data protection questions is info@corpshore.solutions, routed to the group's data protection function.
Let us look at the numbers for your case
Tell us which processes you want to outsource, in which languages and at what volume. We come back with a euro estimate and an operating design, with no commitment.
We reply within 6 hours on working days. If you would rather write: info@corpshore.solutions