Trust centre
Answers before the questionnaire arrives
A regulated buyer’s security questionnaire arrives before the second meeting. Everything it asks that we can answer in public is answered here, so that vendor review is a check rather than a three-week email thread.
These pages state the real posture, including what is in progress and what has not been started. An aspirational trust page is the one thing an enterprise buyer verifies, and the sixth page below exists specifically to hold what is not finished.
Security posture and controls
Access control, secrets, change management, logging and endpoint posture — each with its state stated.
Certifications and audit status
What is held, what is under way with a target, and what has not been started.
Data processing and subprocessors
Subprocessor categories, residency, and the engagement-specific register provided at onboarding.
Vulnerability disclosure
How to report, what is in scope, and what we commit to in return.
Business continuity
Engagement continuity, source custody, backup and restore, incident response.
What is in progress rather than complete
The controls and pages that are not finished, each stated with why.
Where the group line falls
Group-level legal terms — privacy, contracting entity, corporate governance — are canonical on gda.group and linked rather than duplicated (D-I). Practice-level security and subprocessors are published here, because they are specific to what we operate. Where a certification is held at group level rather than by the practice, the certifications page names which.
If you need something not published here
Entity details, insurance certificates, tax forms and our MSA and DPA positions are provided in advance on how to buy us. Anything else, ask — and if the answer is that we do not hold it, that is the answer you will get.