Our computing infrastructure is hosted in the cloud and powered by Heroku.
Heroku’s physical infrastructure is hosted and managed within Amazon’s secure data centers and utilises Amazon Web Service (AWS) technology.
Cyber Essentials Plus certification
50skills maintains rigorous security standards and undergoes regular assessments to ensure compliance with industry requirements.
50skills has been awarded the Cyber Essentials Plus certification, independently verified by The IASME Consortium (BlockMark Registry). This certification demonstrates our commitment to protecting against cyber threats through the implementation of essential security measures.
At 50skills, your data security is our highest priority. We've partnered with Cobalt, a leading provider of penetration testing, to rigorously evaluate the security of our Journeys application.
We are proud to share that the application successfully meets their stringent security standards, demonstrating our commitment to providing a secure and trustworthy platform.
Our proactive approach to security includes adhering to industry best practices, such as the OWASP Application Security Verification Standard (ASVS), implementing robust password policies, ensuring secure session management, and regularly validating system integrity. By maintaining these high standards and conducting ongoing security assessments, we ensure that your data remains safe and secure. For further information, feel free to reach out to us.
Trusted partner for years
Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards.
Amazon’s data center operations have been accredited under: ISO 27001, SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II), PCI Level 1, FISMA Moderate and Sarbanes-Oxley (SOX).
Frequently asked questions
We take a multi-layered approach to security, leveraging both our sub-processors' robust compliance frameworks and our own internal audits and testing.
If you have additional questions please contact us directly at security@50skills.com
What is the data retention policy for traveller records?
We do not enforce an automatic retention window for any traveller records. Traveller data remains in your account until manually deleted by an authorised user. You can establish internal policies to determine when and how often to remove data, and our platform allows you to create workflows to enforce those policies. Once deleted, the data is permanently removed from our systems.
Which third-party data processors do you use, and are they GDPR-compliant?
We work with trusted third-party providers that meet industry-leading security and compliance standards. Examples of sub-processors include:
Hosting and infrastructure
- Amazon Web Services (AWS): ISO 27001-certified, SOC 2-compliant, GDPR-compliant - Heroku (Salesforce Platform): Built on AWS, ISO 27001-certified, SOC 2-compliant Security
- Expedited WAF: Web Application Firewall aligned with GDPR and security best practices Communication providers (optional services)
- Mailgun (Email): GDPR-compliant with Data Processing Agreements - Twilio (SMS): GDPR-compliant with a Data Processing Addendum AI providers
- OpenAI: Under a Data Processing Addendum (DPA), OpenAI does not use our data for model training and follows GDPR guidelines More details or documentation can be provided upon request.
Does OpenAI use our data for model training?
No. Our Data Processing Addendum with OpenAI ensures that any data processed through their API is not used for training or model improvements. OpenAI retains data only briefly to process requests, after which it is deleted in accordance with their policies.
How do your AI Agents work if the LLMs do not retain data?
All of our LLM-based AI agents function on a per-request basis:
- When a workflow includes a "ChatGPT action," data is securely sent to OpenAI for processing - OpenAI does not retain or train models on this data - Our platform only stores the AI-generated response if you choose to save it within your workflow - If deleted, the data is permanently removed from our system This ensures compliance with data privacy and security best practices.
Is traveller data isolated per customer?
Yes. Although our platform operates as a multi-tenant SaaS application, each customer account is logically isolated. This ensures that only authorised users within your organisation can access your traveller data, which is never shared across accounts.
Do you use encryption and other security best practices?
Yes. We follow industry-leading security measures, including:
- Encryption in Transit: All data exchanges are encrypted using TLS 1.2 or higher - Encryption at Rest: Stored data is protected with AES-256 encryption - Infrastructure Security: Hosted on ISO 27001- and SOC 2-certified providers (AWS & Heroku) - Access Controls: Role-based access, Single Sign-On (SSO), and Multi-Factor Authentication (MFA) - Proactive Monitoring: Regular system logging and vulnerability assessments
What encryption standards do you use?
- At Rest: AES-256 encryption for databases and stored files - In Transit: TLS 1.2 or higher for secure data transmission - Endpoint Security: All employee devices are encrypted and centrally managed
Do you conduct third-party security audits?
While we do not hold our own ISO 27001 or SOC 2 certification, we maintain: - Cyber Essentials Plus Certification: A government-backed, independently verified cybersecurity standard - Regular Penetration Testing: Conducted by external security firms - ISO 27001 and SOC 2 Compliant Hosting Providers: AWS and Heroku adhere to these rigorous security standards