What your assessors will ask for.
And what we send them.
Regulated organisations and public services assess a supplier before it touches an important system. This page lists what our due-diligence pack contains, so your procurement and security teams know what to expect.
What’s in the pack.
We send these on request, for procurement, data protection and security assessments.
Certificates
Our ISO/IEC 27001:2022 certificate and scope statement, and our Cyber Essentials Plus certificate. We are also registered on the NHS Data Security and Protection Toolkit.
Data processing agreement
The data processing agreement is part of our standard master services agreement.
Sub-processor list
The tools and services we use to deliver managed services. We apply security requirements to our own suppliers.
Data residency and retention
Where your operational data is stored, and for how long, for each of the regions we support.
Questionnaire responses and evidence packs
Answers to security questionnaires, and evidence that our controls work in practice.
SLA evidence and audit rights
How we report against our service levels, and the audit rights available to you.
The answers your assessors will look for.
| Incident classification | We classify incidents from SEV-1 to SEV-4. Each record includes the timeline, impact, root cause and fix. Every SEV-1 incident gets a blameless postmortem. |
|---|---|
| Response commitment | With Critical Support, SEV-1 and SEV-2 incidents get a contractual 15-minute response, 24 hours a day. |
| Change control | Material changes go through our change advisory board, and you approve any change to your environment. We document emergency changes afterwards, with the reason. |
| Access | Our access follows least privilege, with just-in-time access and no standing admin sessions. You keep admin and IAM control at all times. |
| Audit trail | Datadog keeps an audit trail of operational activity. You have full, real-time access to your own Datadog account, so you see what we see. |
| Data location | Datadog offers EU hosting (Frankfurt) and UK hosting (AWS Europe London region). Cloud workloads can stay in Azure UK regions. Details are on our security page. |
| Fourth parties | Our sub-processor list is in the pack. Datadog publishes its own sub-processors and data processing addendum. |
| Regulation | We operate and evidence the runtime controls that support your compliance obligations, including under DORA and NIS2. |
This is not legal advice. DORA, NIS2 and similar rules place obligations on your organisation as the regulated entity. The assessment is yours to run. The inputs are ours to provide.
Ready to start your assessment?
Tell us what your procurement and security teams need, and we’ll send the pack.