Legal and security

You are about to sign up

The terms and the privacy notice. Between them they cover what we owe each other and what happens to your data, including the region you choose at signup, which is permanent from that moment. There is no United Kingdom region; organisations in the United Kingdom should choose the European Union.

Your organisation handles other people's data

Which is almost every organisation using a CRM. Add the data processing agreement, because your customer records are yours and we handle them on your instructions. You are the controller of those records and we are the processor, in the sense the Data Protection Act 2018 uses those words, which is why a request from an individual comes to you rather than to us.

Someone is doing supplier diligence

The security page and the sub processor list. Start with the section on the security page headed six things we do not have, because for a diligence reader that is the more useful half and most suppliers do not provide it.

You are checking whether the product will work for you

The accessibility page lists what is enforced by automated tests and, more usefully, what has not been tested at all. If you use assistive technology, that second list is the honest answer to whether this will work for you today.

What we do not hold

No SOC 2. No ISO 27001. No published penetration test. If your process requires any of those, we do not currently pass it, and no amount of correspondence will change that this quarter, and we will not sign a questionnaire asserting one either. That is the first thing on this page for a reason. There are no customer logos or testimonials either, which the customers page says in those words rather than leaving the absence to be noticed.

What is built and not yet enabled

Two protections are written, tested and not switched on in production, and the security page names both instead of describing them as though they were live. A supplier who tells you about the gap between built and enabled is telling you something about the rest of their claims as well.

How separation actually works

Each organisation has its own database inside its own isolated compute, rather than a share of one database with a condition on each query. A query written without a customer condition cannot return the wrong customer's data because there is nowhere for it to go. Behind that, each object refuses a request naming a different organisation, so a routing mistake produces a refusal rather than a disclosure. The reasoning behind one database per customer, including what it costs us, is written out at length.

What happens to data at the end

Thirty days of retention so a mistake can be undone, then deletion, then at most thirty further days for backups to age out. Deletion removes a database instead of marking rows, which is a materially stronger form of deletion and a consequence of the architecture rather than a policy.

Who at Consonas can read your records

Nobody, in the ordinary course. Access happens where you have asked for support that requires it, is limited to the people who need it, and is recorded. Your data does not train models, ours or anyone else's, and is never sold in any form.

What we commit to on notification

Twenty four hours from becoming aware of a breach affecting your data, with what we know at the time instead of a complete narrative later. Your own clock towards the Information Commissioner's Office starts when you know, which is the whole reason ours is shorter than the law asks of us. We will also tell you about incidents that did not become breaches where they affected your service.

That is a promise we make, not a thing our software does, and the two are worth keeping apart. What the software does is hold the clock: an incident is declared in the operator area with what is known and which organisations it touches, the moment is stamped, both deadlines are counted from it, and any organisation still owed a message after its twenty four hours appears on a list of what is overdue. The message itself is written by a person. Nothing here sends you an automatic letter about a breach, and nothing should.

Where the obligations sit by plan

They do not sit by plan. The audit trail, consent records, subject access tooling, two factor sign in and complete export are on every plan including the free one, permanently. The data processing agreement applies to free customers without being requested, which is why it is published here rather than sent on request.