The vendor due diligence pack.
Everything an IT, security, or procurement reviewer normally asks us for, in one place. Current versions, no email required. If your questionnaire needs something that is not here, ask and we will answer it directly.
Documents
- Security overview (PDF)
Architecture, data handled, access control, encryption, application security, monitoring, backup and recovery, incident response, retention, and our certification position. Offered in lieu of an ISO 27001 certificate. - Data protection impact assessment (PDF)
A voluntary DPIA for the TPS/CTPS screening processing: what is processed, necessity and proportionality, risks, and mitigations. - Acceptable use policy (PDF)
The rules that bind anyone with access to TPSClear systems: credentials, secrets, customer data, and devices. - Secure development standard (PDF)
OWASP-aligned development practice: input handling, secrets, least privilege, dependency gates, and fail-closed design.
Published policies
- Sub-processor list: every third party that touches service data, and what for.
- Privacy policy: how we handle personal data, as controller and as processor.
- Terms of service: the agreement the service runs on.
- Data Processing Agreement: applies automatically under the terms of service.
Available on request
A countersigned copy of the Data Processing Agreement, plus our fraud risk and modern slavery risk assessments. Ask us and we will send the current versions.
Who this is for. These documents are written for vendor onboarding and security review. If you are evaluating the product itself, start with how it works or pricing.