Security & compliance
Sensitive information.
Serious controls.
Control who can access applicant information and keep evidence, reviews and decisions connected throughout the process.
Access and roles.
Application records can contain identity, income and household information. Give people access according to their role and the work they need to do.
Documented access controls support least privilege and the review of access as responsibilities change.
- Role-based access controls
- Staff permissions limit access to the information relevant to their role and responsibilities.
- Multi-factor authentication
- MFA protects AWS infrastructure administration. Authentication requirements for a particular application workflow should be confirmed as part of its setup.
- Secure document management
- Keep supporting documents within the controlled application workflow, with access restricted to authorised users.
A connected audit trail.
Keep evidence, checks, reviewer actions and decisions together. A transparent decision history lets authorised teams understand how an outcome was reached.
For housing providers, that includes the record behind application reviews, eligibility assessments and allocation decisions.
- Evidence & review history
- Retain the documents supplied, requests for further information and reviewer actions with the case.
- Decision records
- Keep the assessment outcome and supporting rationale available for review.
- Operational reporting
- Use records and reporting to support internal governance, operational oversight and audit requirements.
Data handling and hosting.
Hosted in Ireland
The platform is hosted on Amazon Web Services in the EU West (Ireland) region.
Encryption
Applicant information is protected with encryption in transit and at rest.
Security processes
Documented incident procedures cover logging, triage and escalation. Notification responsibilities are set out in the applicable data processing agreement.
Retention & deletion
Data handling, retention, export and deletion responsibilities are agreed with the organisation acting as data controller.
Documentation for your data protection review.
Keyholder supports your organisation’s GDPR responsibilities with structured records, access controls and documented data handling.
Review the lawful basis, evidence requirements and retention arrangements for your process. Your organisation remains responsible for its assessment and data protection decisions.
- Data processing agreement
- Request the applicable DPA and service information for your procurement or data protection review.
- Privacy & governance
- Use the privacy notice and agreed procedures to inform lawful basis documentation, subject access requests and retention arrangements.