UK US
Book a demo
Security

Security isn't a feature. It's the foundation.

Taking security and privacy seriously.

Knowa is used by boards and committees across UK pensions, charities, schools, and family offices. Security is designed into the platform from the start. Built around documented controls and independent ISO 27001 certification.

A board works above three interlocking foundation layers while a custodian manages the entrance.
Certification and control frameworks

The frameworks Knowa is built to.

ISO 27001
Certified
GDPR
Aligned
UK DPA 2018
Compliant
NIST CSF
Aligned
SOC 2
Aligned

Our posture

Every organisation using Knowa expects its data to remain private and protected.

We continuously strengthen Knowa to meet the evolving challenges of security and cyber threats. Every organisation using our platform expects its data to remain private and protected, and we've built Knowa with that responsibility at its core.

Knowa is ISO 27001 certified and designed in alignment with GDPR, the UK Data Protection Act 2018, and the NIST Cybersecurity Framework.

While we don't disclose sensitive details about our defences, transparency matters. Below, we've outlined the key measures and standards that ensure Knowa remains a secure, compliant, and trusted environment for our clients.

01
Data Encryption
All user data is protected in transit and at rest. We use FIPS 140-2 certified AES-256 encryption at rest and TLS 1.3 in transit, with ECDSA and RSA algorithms. Encryption keys are managed under strict access controls with regular rotation.
02
Server & Infrastructure
Knowa is hosted on tier-one cloud infrastructure with physical security, redundant power, and 24/7 monitoring. Servers are hardened to industry benchmarks with continuous patching, intrusion detection, and automated failover. Separate production, staging, and development environments.
03
People & Access
All staff undergo background checks and sign confidentiality agreements before access to production. Access follows least-privilege principles. Privileged access is reviewed quarterly and revoked immediately on role change. Staff receive annual security and data-protection training.
04
Logging & Monitoring
Every authentication, access, and administrative action is logged with tamper-evident timestamps. Logs are retained in immutable storage. Anomaly detection monitors for suspicious patterns. Security events escalate to on-call engineers with defined response times.
05
Development & Testing
Secure software development lifecycle with mandatory peer code review, automated static analysis, and dependency vulnerability scanning. Independent penetration testing is conducted at least annually. Security fixes prioritised by severity with tracked remediation SLAs.
06
User Access & Authentication
Customers control their own users, roles, and permissions. Multi-factor authentication available for all accounts. Single sign-on (SSO) supported for enterprise customers. Session management, password policies, and account lockout aligned to NIST guidance.
07
Custom Governance Controls
Administrators can configure permissions per-workspace, per-document, and per-user. Sensitive records can be restricted to named individuals. Full audit trail for every access, edit, download, and share. Data residency and retention policies configurable to your organisation's requirements.

For your security review

The detail your team needs to check.

Ask for the current security review pack. Tell us your organisation, preferred hosting region and any questions from your IT, privacy or procurement team.

Certification and scope

Knowa is ISO 27001 certified. Request the current certificate, its scope, issuing body, validity dates and Statement of Applicability. NIST CSF and SOC 2 alignment describe control frameworks; they are not additional certifications or a claim to a SOC 2 attestation.

Hosting and data locations

For your UK deployment, ask us to confirm the primary hosting region, backup locations and any processing in other countries. The review should cover both the platform and the services it uses.

AI processing

Ask which providers process each AI feature, where that processing takes place, how long inputs and outputs are retained and how model-training restrictions are applied. Review these arrangements alongside the permissions and human review controls.

Subprocessors and contracts

Request the current subprocessor list and Data Processing Addendum, including each provider's purpose, location, transfer arrangements and the process for notifying you of changes.

Retention, export and deletion

Agree the retention period for your records, backups and any Archive service. Ask how you export your information, end access and request deletion when the contract ends.

Testing and response

Ask for the available independent testing summary, remediation process and incident-notification arrangements. Include any questionnaire your team needs us to complete.

Request the security review pack

Include your organisation and the areas you want to review. We can discuss access to supporting documents with your security team.

Security you can stand behind. Governance you can stand on.

See how Knowa brings enterprise-grade security to every trustee meeting, charity board, and governing body.

Book a demo →