Security & Compliance

Certified, audited,
and operationally accountable.

Critical Cloud holds ISO 27001 and Cyber Essentials Plus. Our operations, incident management, change control, observability, and access governance, are designed to help customers meet their own regulatory obligations, including DORA and NIS2. EU and UK data residency is available.

Request documentation Partner credentials

ISO 27001

Certified, ISO/IEC 27001:2022

CE Plus

Cyber Essentials Plus certified

EU + UK

Data residency options

DORA & NIS2

Operational support for regulated customers

Our posture at a glance

ISO 27001:2022 certified, independent audit of our information security management system
Cyber Essentials Plus certified, UK government-backed scheme, technically tested
NHS DSPT registered, Data Security and Protection Toolkit for health and care data
Least-privilege access, IAM controls, just-in-time access, no standing admin sessions
Structured incident management, SEV-based severity model, documented postmortems
Change control, CAB process, customer approval for material changes
Sub-processor transparency, documented, available on request

Certifications

Independently audited and certified

Both certifications are maintained and renewed, not a one-off assessment. Documentation is available on request for procurement and due diligence processes.

Information security management

ISO/IEC 27001:2022

ISO 27001 is the international standard for information security management systems (ISMS). Certification means our policies, controls, and processes for managing information security risk have been independently audited and verified against the standard's requirements.

Risk assessment and treatment across our operations
Access control, cryptography, and physical security controls
Incident management, business continuity, and supplier relations
Annual surveillance audits and three-year recertification cycle

Certificate and scope statement available on request.

UK government-backed cyber security

Cyber Essentials Plus

Cyber Essentials Plus is the UK government-backed certification scheme covering five core cyber security controls. The "Plus" level involves independent technical testing, not self-assessment, verifying that the controls are actually in place and functioning.

Firewalls and network boundary controls
Secure configuration of devices and services
User access control and privilege management
Malware protection and software patching, technically verified

Certificate available on request for supplier onboarding and due diligence.

Regulatory readiness

Supporting customers subject to DORA and NIS2

We don't provide legal advice, and regulations place obligations on you, not on us. What we do is run the operational infrastructure, observability, incident management, change control, postmortems, in a way that is designed to help you evidence and meet those obligations.

DORA, Digital Operational Resilience Act

DORA requires EU financial services firms to demonstrate operational resilience: ICT risk management, incident classification and reporting, digital operational resilience testing, and oversight of third-party ICT providers.

How our operations support this:

ICT incident management: SEV-based incident classification, documented response timelines, and blameless postmortems, the audit trail DORA reporting requires
ICT risk management: ISO 27001 ISMS provides the risk assessment and treatment framework; Datadog observability provides continuous visibility into the operational risk posture
Third-party ICT oversight: we operate as a regulated third-party ICT provider; sub-processor documentation, SLA evidence, and audit rights are available on request
Resilience testing support: our alliance with Tarian Labs can provide penetration testing and resilience assessments alongside your DORA testing programme, see Continuous Runtime Security Validation

NIS2, Network and Information Security Directive

NIS2 extends security and incident-reporting obligations to a broader set of sectors, including digital infrastructure, managed service providers, and cloud services, across EU member states. It requires risk management measures, supply chain security, and timely incident notification.

How our operations support this:

Risk management measures: ISO 27001 ISMS, change control, access governance, and the improvement engineering programme address the technical and organisational measures NIS2 requires
Incident reporting: our SEV-1 incident management process documents timeline, impact, and root cause, the raw material for NIS2 72-hour notification obligations
Supply chain security: sub-processor list and contractual security requirements available; we apply security obligations to our own suppliers
MSP scope: as a managed service provider, we operate within NIS2's scope and maintain the security measures the directive requires of providers in our category

DORA and NIS2 are not the only gates. A DPIA and a security information risk assessment (Security ISR) often sit between supplier selection and go-live, especially in health and the public sector. We provide what those assessments need: the DPA embedded in our standard MSA, our sub-processor list, data residency and retention positions, current certificates, security questionnaire responses, and evidence packs. The assessment is yours to run. The inputs are ours to provide.

This is not legal advice. DORA and NIS2 impose obligations on your organisation as the regulated entity. How our operations map to your specific obligations depends on your sector, jurisdiction, and circumstances. We can provide operational documentation to support your compliance programme, talk to us or your legal advisers for guidance specific to your situation.

Data residency

EU, UK, and data sovereignty options

Where your observability and operational data is stored matters, for GDPR, for Swiss nDSG, and for customers in regulated sectors. Datadog offers EU, UK and US hosting options; we configure your environment to match your residency requirement.

Region / requirement	Datadog site	Relevance
EU data residency	Datadog EU1 site (eu1.datadoghq.com), data stored in Frankfurt, Germany	Meets GDPR cross-border transfer requirements for EU customers; supports DORA data-localisation preferences
UK data residency	Datadog's UK availability zone (AWS Europe London region, live since July 2026) for UK-only mandates; Datadog EU1 with UK adequacy decision as an alternative; Azure UK regions for cloud workloads	UK GDPR-compatible; UK adequacy decision maintains equivalence for EU→UK transfers post-Brexit
Switzerland (nDSG)	Datadog EU1 (data stored in Germany / EU); Switzerland-EU SCCs where relevant	Swiss nDSG aligns closely with GDPR; EU1 site and appropriate transfer mechanisms support Swiss data-residency expectations
Ireland	Datadog EU1	GDPR-native; EU site ensures all observability data remains within the EEA
EMEA (other markets)	EU1 or US1, configured per customer requirement	We advise on the right Datadog site for each customer's jurisdiction and sector obligations

Datadog's own sub-processors and data processing addendum are published by Datadog at datadoghq.com/legal/sub-processors. Critical Cloud's sub-processor list is available on request.

Operating model

How security is built into how we operate

Security controls are operational, not documentary. They show up in how we manage access, run changes, and handle incidents, every day, for every customer.

ISO 27001 IMS

Our Information Management System defines how we assess and treat risk, manage policies, train staff, audit controls, and handle non-conformances. Annual surveillance audit; three-year recertification cycle.

Structured incident management

SEV-1 to SEV-4 severity classification, documented response timelines, and blameless postmortems for all SEV-1 events. Incident records include timeline, impact, root cause, and remediation actions.

Change control & CAB

All material changes to customer infrastructure go through our Change Advisory Board process. Customers approve changes that affect their environment. Emergency changes are documented post-event with full rationale.

Least-privilege access

Access to customer environments follows least-privilege principles. IAM controls and access governance reviews are part of the standard operating model. Customers retain admin and IAM control at all times.

Observability and audit trail

Datadog provides a continuous, tamper-evident audit trail of operational activity. Customers have full, real-time access to their own Datadog environment, visibility is not restricted to Critical Cloud engineers.

Sub-processor handling

We maintain a documented sub-processor list covering the tools and services used in delivering managed services. Available on request for procurement, DPA, and compliance purposes.

Runtime Evidence

Get the boxes ticked without a project

An auditor, an NHS body, an enterprise customer and a tender all ask versions of the same questions. Where does the data live? Who are the sub-processors? What is retained, and against which policy? Which certificates are current? The answers exist by name: DPA, sub-processor list, data residency and retention positions, certificates, and security questionnaire responses. Ask, and they arrive.

Behind the documents sits Runtime Evidence, not compliance theatre. Good operations produce evidence as a by-product: incident records, access governance, change context, recovery evidence, SLO reporting and assurance packs. We operate and evidence the runtime controls that support your compliance obligations. Learn more about Runtime Evidence as part of Managed Runtime Assurance.

Disclosure

Found something? Tell us directly

If you have found a security issue in this website or in a service we operate, email security@criticalcloud.ai. Tell us what you found and where, how to reproduce it, and what an attacker could do with it. Please report privately first and give us a reasonable window to respond before disclosing publicly.

You will get an acknowledgement within one working day, an initial assessment within five working days including whether we have reproduced it, and progress updates until it is resolved or we explain why we are not treating it as a vulnerability. We do not run a paid bug bounty, and we are glad to credit reporters who ask to be named once an issue is closed.

In scope: criticalcloud.ai and its subdomains, and the services we operate for customers. Out of scope: third-party platforms we use rather than control, volumetric denial of service, social engineering, and automated scanner output with no demonstrated impact. Please do not access, modify or remove customer data. If a proof of concept would require it, stop and describe what you would have been able to reach.

Need security documentation for procurement or compliance?

ISO 27001 certificate, Cyber Essentials Plus certificate, NHS DSPT registration, and sub-processor list, available on request. The DPA is embedded in our standard MSA, so it is in place from signature rather than requested and negotiated separately.

Request documentation About Critical Cloud

Certified, audited,and operationally accountable.