1. Security posture
- Encryption — TLS 1.3 at the edge (TLS 1.2 is currently accepted as a fallback for legacy browsers on the public marketing surface; a TLS-1.3-only flip is scheduled once the customer traffic-mix is measured). AES-256 at rest for application databases and object storage.
- Authentication — password policy, optional SSO (SAML / OIDC), role-based access control with least-privilege defaults and separation of duties for administrative actions.
- Tenant isolation — data-scope middleware enforces per-organisation access on every deal and fund query. Audit logs record every privileged action.
- Infrastructure — AWS, UK / EU / US regions selectable at contract time. Isolated environments for development, staging, and production.
- Secrets — managed via AWS SSM Parameter Store / Secrets Manager with per-environment KMS keys. No secrets in source control.
- Dependency hygiene — automated vulnerability scanning on every commit; critical CVEs patched within 7 days.
2. Compliance status
No formal attestation has been issued. MARKST LTD is a recently incorporated company; the position at 26 September 2026 is set out below. This section is updated when a certification body or auditor is appointed, not against a target calendar.
- ISO/IEC 27001 — internal gap assessment against ISO/IEC 27001:2022 Annex A completed April 2026. Core ISMS documents drafted and in use internally: scope, information security policy, risk register, Statement of Applicability, asset inventory, incident-response plan, supplier register. No certification body appointed; no certification date committed.
- SOC 2 Type I — readiness work carried out in-house against the same control set. No auditor engaged; no observation period scheduled.
- SOC 2 Type II — follows Type I; not scheduled.
- Cyber Essentials Plus — not yet applied for.
Until attestations are issued, controls are operated to the standards above and progress evidence is shared with customers under NDA on request.
3. Penetration testing
No independent penetration test has been carried out yet. Automated dependency and static-analysis scanning runs on every commit (§1). An independent test is planned before the first customer book goes into production, with annual repeats and targeted reviews when major features ship thereafter. A redacted summary will be available under NDA from security@markst.com once the report is issued.
4. Subprocessors
A list of the third parties we engage to deliver Verus is maintained at /legal/subprocessors. We notify customer contacts in advance of material changes.
5. Data Processing Agreement (DPA)
Our standard DPA includes UK IDTA + EU Standard Contractual Clauses for international transfers. See /legal/dpa for scope, annexes, and a one-click request CTA; enterprise customers may negotiate specific terms in the master agreement.
6. Incident response
We maintain a documented incident-response runbook covering detection, triage, containment, eradication, recovery, and post-incident review. Customers whose data is affected by a personal-data breach will be notified without undue delay and, where required by UK / EU GDPR, within 72 hours of awareness.
7. Responsible disclosure
Please report suspected security issues to security@markst.com. Our machine-readable policy lives at /.well-known/security.txt per RFC 9116.
Safe harbour. Good-faith research conducted under this policy will not be pursued legally by MARKST LTD, provided you:
- Do not access data belonging to other customers.
- Do not run automated scanners against production.
- Do not attempt to disrupt service or modify data.
- Give us reasonable time to remediate before public disclosure.
- Use a clearly labelled test account and short-lived user-agent.
8. Contact
Security: security@markst.com
Data protection: dpo@markst.com
Procurement / DPA: legal@markst.com