Quality and data security at Great Space
Brokers and providers trust us with client briefs, commercial terms and contact details. This page sets out how we protect that information and how we check our own work, and what we commit to do next.
Last reviewed 23 October 2026
Our commitments
Six promises that shape how we build and run Great Space.
Your information stays yours
Each organisation's data is kept separate from every other organisation's. Only the people you invite can see it, and only the parts you choose to share leave your account.
We test continuously, not once a year
Security checks run every day, with a deeper review of the whole platform every quarter. We would rather find a problem ourselves than have you find it.
We fix what we find, on a deadline
Every confirmed weakness is recorded permanently, given a severity and fixed within a published timeframe. Fixes are proven with tests before they are closed.
Independent experts will check our work
Our own review is not enough on its own. We commit to an annual penetration test by an independent, CREST-accredited specialist, and to re-testing the fixes.
We use recognised standards
We measure ourselves against well-known industry standards, named below, rather than a yardstick of our own making.
We tell you when it matters
If something goes wrong that affects your information, we investigate straight away and tell the people affected without undue delay.
The standards we work to
We name our standards so you can hold us to them.
OWASP Top 10 (2025)
The industry reference for the most serious web application risks, from broken access control to injection and misconfiguration. Our quarterly review covers every category.
OWASP API Security Top 10 (2023)
The matching reference for the interfaces that power our product and integrations. We test authorisation, abuse resistance and data exposure against it.
OWASP Top 10 for LLM Applications (2025)
The reference for AI-specific risks such as prompt injection, data leakage and unsafe handling of AI output. It guides how we test SpaceAI and our other AI features.
UK GDPR and the Data Protection Act 2018
How we collect, use and protect personal data. Our privacy notice sets out the detail, including the providers that process data on our behalf.
SOC 2 and ISO/IEC 27001:2022
We are building our controls to meet both frameworks. We are not yet audited or certified, and we will say so plainly here when that changes.
How we test
Quality and security are checked at several levels: our code, our AI features, our third-party components and our cloud environment.
- Operating Running today.
- Scheduled Committed, with a date set.
- Planned On our plan, with no date set yet.
We update this page as items move.
| Check | What it covers | How often | Status |
|---|---|---|---|
| Automated checks and test suite | Type checking, code-quality checks and a large automated test suite, covering core behaviour including who can see and change what, run on every proposed change and every merge. The results are kept. | Every change | Operating |
| Review of every change | It is our policy that every change to our software is reviewed by our CTO and passes our automated checks before it is released. | Every change | Operating |
| Daily automated security review | Every day we review what changed in our software and the third-party components it relies on, looking for new weaknesses before they reach customers. | Daily | Operating |
| Quarterly full security review | A structured review of the whole platform against the OWASP standards. Every finding is independently challenged before it is accepted, so effort goes into real problems. | Every quarter | Operating |
| AI feature testing | We test our AI features for prompt injection, leakage of information between customers and unsafe use of AI output, using the OWASP LLM guidance. | Quarterly and on major change | Operating |
| Third-party component monitoring | Software we depend on is checked for known weaknesses as part of the daily review, with automated alerts being added so nothing waits for the next run. | Continuous | Operating |
| Cloud infrastructure and configuration review | A review of how our cloud environment is set up: who and what can access what, how data is stored and protected, and how we would spot misuse. | Annually and after major change | Planned |
| Independent penetration test | A CREST-accredited specialist firm attacks the platform as a real adversary would, with a re-test to confirm fixes. We will share a summary of the results with customers on request. | Annually | Planned |
| Backup and recovery testing | We take regular backups today. We commit to proving at least once a year that we can restore from them, and to recording how long it takes. | Annually | Scheduled |
| Access reviews | We review who on our team can reach which systems and remove anything no longer needed. | Every quarter | Operating |
| Security training for our team | Everyone at Great Space completes security awareness training each year. | Annually | Operating |
What happens when we find something
Every confirmed weakness is recorded permanently: what it is, when we found it, how serious it is and when it was fixed. Nothing is deleted from that record. We commit to getting each fix into production within these times, counted from the day we confirm it.
-
7 days
Critical
Exploitable now by an outsider, or exposes one customer's data to another.
-
30 days
High
Serious impact with modest preconditions.
-
90 days
Medium
Real impact, but needing narrow circumstances.
-
180 days
Low
Hardening and defence in depth.
If something does go wrong that affects customer information, we investigate and contain it straight away, tell the people affected without undue delay, and notify the Information Commissioner's Office where UK GDPR requires it.
How we protect your information
The principles behind the product, without the detail an attacker would want.
Separated by organisation. Customer data is partitioned so that one organisation cannot read another's, and every request is checked on our servers, not only in the app.
Roles and least privilege. Team members get the access their role needs. Administrative actions, such as inviting people or changing settings, are limited to administrators.
Encrypted. Information is encrypted in transit and when stored.
Sign-in without passwords. Customers sign in with a one-time code, so there is no password to steal or reuse. Our own team uses two-factor authentication on our core business systems.
A record of changes. Changes to customer data are logged with who made them and when, so activity can be investigated.
Backed up and monitored. Regular automated backups and round-the-clock uptime monitoring.
Hosted in the UK and EU. Our primary infrastructure runs in Google Cloud regions in the UK and EU.
A short list of vetted suppliers. We use a small number of established suppliers and review them. They are listed in our privacy notice.
AI that works within your permissions
SpaceAI and our other AI features are designed to work within the permissions of the person using them, and to treat text from outside sources, such as emails, websites and documents, as untrusted. We test them against the OWASP guidance for AI applications.
Report a security concern
If you think you have found a weakness in Great Space, please tell us at info@greatspace.ai with "Security" in the subject line. Include what you found and how to reproduce it.
Please do not access other people's data, disrupt the service or use social engineering, and give us reasonable time to fix the problem before sharing it. We will keep you informed, and credit you if you wish.
FAQ
Security questions
Is Great Space SOC 2 or ISO 27001 certified?
Not yet. We are building our controls to meet SOC 2 and ISO/IEC 27001:2022, and independent audit and certification are part of our plan. We will update this page when that status changes.
Has Great Space been penetration tested?
Not yet. An annual penetration test by an independent, CREST-accredited provider is on our plan but has not been completed or dated. Once we have results we will share a summary with customers on request. In the meantime we run daily and quarterly security reviews of our own.
Where is my data stored?
Our primary infrastructure is hosted in Google Cloud regions in the UK and EU. Our privacy notice lists the suppliers that process data on our behalf.
Who can see my data?
The people in your organisation whom you invite, according to their role, plus whatever you choose to share through a referral or a Portal. Access by Great Space staff is restricted to what is needed to support you.
Can you complete our security questionnaire?
Yes. Contact us and we will complete your questionnaire and answer follow-up questions about anything on this page.
Need more detail for a security review?
We complete customer security questionnaires and are happy to talk through anything on this page.