FOR SECURITY, COMPLIANCE & PROCUREMENT
Review where data lives, how access is controlled, what is monitored, how recovery is designed and which team owns each layer. Where a claim depends on the deployment or contract, DC Core says so.
ISO 27001 and SOC 2 readiness are roadmap positions—not completed certifications.
ASSURANCE WITHOUT THEATRE
A technically true statement can still mislead when its scope is hidden. DC Core pairs security and resilience claims with the service, environment and customer responsibility to which they apply.
The standard managed design keeps primary tenancy data in London with recovery capacity in France. Global relays can process encrypted traffic or limited metadata but are not intended as primary tenancy-data storage.
Review authentication, roles, tenant and device ownership, command authorisation, logging and the distinction between platform access and permissions inside customer applications.
Backup, replication and recovery mechanisms support resilience, while customer-specific RPO, RTO, standby capacity and support commitments must be agreed contractually.
THE ASSURANCE ROUTE
The public Trust Centre should answer common questions without an NDA. Customer-specific material is then matched to the service and confidentiality required.
Browse public resources →Start with data processing, residency, encryption, access, logging, suppliers, recovery, support and current compliance progress.
Identify the workload, data types, locations, recovery needs, integrations and infrastructure that would be inside or outside DC Core control.
Document customer duties, third-party dependencies, transitional controls and any requirement that differs from the standard managed design.
Provide appropriate supporting material and ensure service levels, recovery objectives or dedicated arrangements that matter are contractual.
CURRENT POSITION
DC Core publishes the controls it can describe today and avoids presenting planned certifications as completed assurance.
| Area | What can be reviewed now | What still depends on scope or progress |
|---|---|---|
| Platform controls | Access principles, encrypted connectivity, logging, monitoring, segmentation and operating boundaries. | Deployment-specific implementation and customer-side controls. |
| Data handling | Standard UK/EU managed design, processing categories and global relay distinction. | Customer-selected providers, exceptional locations and workload-specific flows. |
| Recovery | Managed backup approach, recovery locations and periodic restore-process checks. | Contractual RPO/RTO, retention, dedicated capacity and application-level testing. |
| Certification | Current readiness roadmap and assurance materials available for the proposed service. | ISO 27001, SOC 2 and Cyber Essentials are not represented as completed certifications. |
LIKELY STARTING POINTS
CUSTOMER DUE DILIGENCE
We will route public answers first, identify deployment-specific questions and provide appropriate assurance material where available and justified.