Most procurement reviews stall on the same eight questions. This page answers them in writing, in one place, so your legal, IT and procurement teams can assess NSDS without an email round trip. Where a control is in place today, it says so. Where something is a target rather than a current state, it says that too.
Every control on this page is one NSDS runs now on client engagements. Nothing here describes an intention or a marketing position. If a control is planned rather than operating, it appears in the certification and roadmap table with that status against it.
Architecture diagrams, access registers, penetration test output, backup configuration and incident records identify systems and people. Publishing them would itself be a security weakness. They are released through the procurement pack request below, under a mutual non-disclosure agreement where the material warrants one.
Each section answers what NSDS commits to, what stays with you, and what evidence exists.
NSDS is a data processor for the personal information it handles on your behalf. You remain the controller. That distinction is not a formality: it determines who decides what the data is used for, and the answer is you.
Access is the control that matters most, because almost every other control depends on it. NSDS works on the principle that a person should hold the narrowest access that lets them do the work, for only as long as the work lasts.
The most common failure in a managed arrangement is an assumption that someone else is taking the backups. NSDS states the split in writing at the start of every hosted engagement so no one is relying on an assumption.
An incident is any event that compromises, or reasonably may have compromised, the confidentiality, integrity or availability of your systems or data. NSDS reports on suspicion, not on confirmation, because a delayed report is worse than an unnecessary one.
NSDS is a specialist firm rather than a large one. Pretending that carries no key-person risk would be dishonest, so instead the risk is managed explicitly and stated openly.
This is where institutional buyers are most often caught out, usually a year later. The NSDS position is straightforward: what we build for you, you own, and you can leave with it.
NSDS delivers with its own team, including part-time staff engaged under written agreement. Outside subcontractors are used rarely and only where a named specialist is the right answer. Anyone who can reach your data is treated as a sub-processor, including the platforms that hold it.
Read this table as the definitive statement. Where a control appears in the sections above as operated, it appears here as operated. Where it is a target, it is labelled a target and carries no implied date until one is committed with you.
| Item | Status | What that means |
|---|---|---|
| Written information security practices | Operated | Documented and applied across engagements. Not independently audited. |
| Named access, least privilege, MFA on administrative accounts | Operated | In force on NSDS accounts holding administrative access to client systems. |
| Encrypted transit and managed certificates | Operated | Applied to every website and application NSDS hosts or manages. |
| Automated backup with tested restore | Operated | On managed hosting engagements, with the schedule and retention set per engagement. |
| Incident response procedure with client notification | Operated | Documented, with escalation contacts issued at the start of each managed engagement. |
| Jamaica Data Protection Act alignment | Operated | Processing, minimisation, retention and deletion practices are built around the Act. |
| GDPR processor terms where the client is in scope | Operated | Offered as contractual terms. NSDS is not established in the EU or UK. |
| WCAG 2.2 Level AA in delivered interfaces | Operated | A delivery standard on NSDS builds, tested during delivery rather than asserted afterwards. It also covers the Ontario obligation: the AODA information and communications standard requires WCAG 2.0 Level AA, so a build delivered to WCAG 2.2 Level AA meets it. NSDS staff have taken AODA training for government work delivered in that market. |
| Responsible disclosure route | Operated | Published, monitored, and reports are acknowledged. |
| Independent penetration testing | In progress | Commissioned on request for a specific engagement today. Not yet a routine annual programme across NSDS platforms. |
| Formal documented ISMS with internal audit cycle | In progress | Practices are documented; the audit cycle is being formalised. |
| Cyber insurance | Target | Not represented as held. Confirm requirements with NSDS before contract if your policy requires cover. |
Operated means NSDS runs the control today. In progress means it is partially in place and being completed. Target means it is neither held nor in assessment, and no date is implied.
The table covers information collected through this website and through an engagement. Retention periods for engagement records are set in your contract, because a regulated client and a small business do not carry the same obligation.
| Information | Why NSDS holds it | Kept for |
|---|---|---|
| Website enquiry and meeting request details | To respond to the enquiry and arrange the meeting | Held while the enquiry may still lead somewhere. No fixed deletion date is set today, and rather than state a period NSDS does not enforce, the position is stated plainly: ask for your enquiry record to be deleted and it is deleted |
| NIA consultation transcripts | To prepare for a consultation and record what was recommended | One hundred and eighty days, then the transcript is deleted automatically and the summary retained |
| Meeting bookings | To hold the appointment and to prepare for it | Twelve months from the meeting date |
| Client contact and account records | To deliver and administer the engagement | For the engagement, plus the statutory period required for business records |
| Client production data on managed systems | To operate the system you contracted | For the engagement, then returned and deleted on the contracted schedule |
| Backups of managed systems | To restore service after failure or loss | The retention window agreed for your engagement, then overwritten |
| Support tickets and correspondence | To provide support and keep an auditable history | For the engagement, plus the period set in your contract |
| Website analytics | To understand which content is useful | Aggregated, not used to identify individuals |
Everything a procurement, legal or IT reviewer normally has to ask for by email, assembled once. The pack is released on request rather than published, because parts of it describe systems and name people. Most requests are answered within two business days.
Ask for what you need rather than all of it. A request that names the standard you are assessing against, or attaches your questionnaire, is answered faster and more usefully than a request for everything.
Requests are reviewed before release. Material that names systems or people is issued under a mutual non-disclosure agreement.
You do. Custom work produced for your engagement transfers to you on payment, and you receive the source code rather than only a running system. Where NSDS pre-existing components are used, that is identified before contract and licensed to you in writing for the delivered system. Third-party and open-source components are listed with their licences.
The hosting region is agreed with you before deployment. If you have a regulatory constraint on where processing may occur, raise it during scoping and it is built into the architecture rather than worked around afterwards. Where you host on your own account with another provider, NSDS documents the same responsibility split against that provider.
You are notified without undue delay once NSDS becomes aware, within the timeframe set in your contract, with what is known at that point rather than a complete picture. A named person owns the incident to closure. Where personal data is involved, NSDS gives you what you need to meet your own duties to the Office of the Information Commissioner and to affected individuals. The regulator notification decision stays with you as controller. A written post-incident report follows.
Work is documented as part of delivery, code and credentials live in shared NSDS systems rather than on one machine, and more than one person holds the access needed to keep a managed service running. If NSDS could not continue an engagement at all, the contract requires that you receive code, data, configuration and documentation in a form another supplier can use.
Yes to both. NSDS will work from your processor terms and your questionnaire rather than insisting on its own format. Where a clause cannot be met, NSDS says which one and why rather than signing and hoping, which is the failure mode that causes problems later.
No. Client data is used to deliver the engagement you contracted and for nothing else. NIA, the NSDS consultation assistant on this website, works from an approved knowledge base about NSDS services and does not learn from, or draw on, client project data.
A reasonable audit right can be agreed contractually, scoped to the systems used for your engagement and with reasonable notice. NSDS cannot grant access to systems or records belonging to other clients, so an audit is scoped to your own engagement.
If a control you assess against is not covered here, ask. An honest answer about what NSDS does not have is more useful to you than a page that claims everything.
