Frequently Asked Questions

All client data is hosted in UK-based, ISO 27001 certified Easyspace data centres operated by the iomart Group. Virtual servers are managed by T3 Network Solutions. Encrypted backups and disaster recovery environments are located separately within the UK. No application data is stored or transferred outside the United Kingdom.

Yes. Each SOTERweb client is allocated a private virtual server that operates within its own isolated environment and is protected by a dedicated firewall. No customer has access to, or the ability to affect, another client's data.

Yes. All data in transit, including browser sessions, authentication data and administrative sessions, is protected over HTTPS using TLS 1.2, with TLS 1.0 and TLS 1.1 disabled. Encryption at rest is enabled within the live production environment, and backups are encrypted at rest using AES-256 encryption. These controls align with UK National Cyber Security Centre guidance and recognised industry practice.

SOTERweb is delivered by Montgomery & Coupers Ltd, a company certified to both ISO 27001 and ISO 9001. We achieved ISO 27001 and ISO 9001 certification in January 2026. We have also maintained Cyber Essentials certification for several years and achieved Cyber Essentials Plus certification in March 2026. SOTERweb can provide summaries or evidence of third party security audits under appropriate confidentiality terms.

Yes. Penetration testing is carried out at least every six months and before any major release or new client go-live, covering both application and infrastructure. Tests are performed by OmniCyber Security, a CREST-accredited cyber security specialist which acquired Equilibrium Security Services. The latest penetration test report or executive summary is available under appropriate confidentiality terms.