Trust, built into every layer of iCHEX.

Encryption

Data is encrypted at rest using AES-256, and in transit using TLS 1.3. SSL 3.0, TLS 1.0 and TLS 1.1 are disabled across all systems. Unencrypted connections are not accepted.

Backup & recovery

Full backups run twice daily, with database transaction logs backed up every 15 minutes. Backup copies are encrypted and geo-redundantly replicated across separate UK facilities, and recovery is tested annually plus after significant changes.

Data retention

Where a client hasn't specified otherwise, candidate data is retained for 12 months from case completion, then automatically purged. Where a client has documented different instructions, those apply instead. On request, data can be exported in a portable format or erased ahead of the standard window.

Tenant segregation

Client data is logically segregated at application and database level. No cross-tenant access is possible.

Automated decisions

iCHEX does not make automated decisions about candidates. Where required, the case is quality-checked by a trained analyst before the report is compiled, and the suitability decision always rests with the client.

Data residency

Candidate data is stored exclusively in UK data centres. Where a check requires processing overseas, for example an international criminal record check, data is transferred under appropriate safeguards (an IDTA or SCCs) and is not stored or retained outside the UK.

Data classification

All data assets are classified under a documented Asset Classification and Control Policy, with handling, encryption and access controls applied according to sensitivity.

Secure destruction

Electronic data is permanently and verifiably deleted at the end of its retention period, including from backups. Physical media and paper records are destroyed by a certified provider, with destruction certificates retained as evidence.

Penetration testing

iCHEX is independently assessed annually, and after significant change, by a CREST-accredited specialist. Findings are remediated to the risk-based timelines set out below, and a redacted summary of the current test is available on request.

Secure development

Security is built in from design: threat modelling and secure architecture review before coding starts, code developed to OWASP Top 10 and Microsoft SDL standards, and mandatory peer review with static code analysis before release. Internet-facing and internal systems are vulnerability-scanned at least quarterly, backed by independent, CREST-accredited penetration testing annually and after significant change.

Vulnerability management

Run under our ISO 27001-certified ISMS, external systems are scanned quarterly and internal systems monthly, in addition to annual penetration testing. Fixes follow risk-based timelines: critical within 24–48 hours, high within 7 days, medium within 30 days, low within 90 days.

Multi-factor authentication

Every user, staff and client alike, authenticates with multi-factor authentication as standard practice when accessing iCHEX.

Session management

Sessions time out automatically after 30 minutes of inactivity, and accounts lock after five unsuccessful login attempts.

API security

All iCHEX APIs are authenticated, rate-limited and monitored. Access requires valid credentials and is logged for audit.

Platform

iCHEX is a browser-based SaaS platform, accessed over HTTPS only. No client-side software or plug-ins are required for tenant users, candidates or referees.

API access

iCHEX exposes a JSON/REST API, authenticated by token-based credentials passed in the request header. API access carries the same tenant- and role-based permissions as the standard interface, and every call is logged for audit.

Tenant integrations

iCHEX integrates with ATS and HRIS platforms via the API, so screening cases can be initiated and tracked without leaving your existing recruitment or HR systems.

Candidate & referee access

Candidates and referees receive a secure, tokenised link to their own portal within iCHEX. No account creation or password is required, and access is time-limited and single-purpose.

Accessibility

Adjustable text size, colour contrast options, keyboard navigation and screen reader support are available throughout iCHEX. We're working towards full WCAG 2.1 AA compliance and are actively reviewing the platform to close any remaining gaps.

Reporting an issue

Candidates, referees and tenant users can report an accessibility barrier at any time through Customer Success, who will log and track it to resolution.

Platform availability

iCHEX targets 99.9% system availability. Planned maintenance is scheduled outside core business hours and communicated to clients in advance.

Incident response plan

A documented Information Security Incident Response Plan, maintained under our ISO 27001-certified ISMS, is reviewed annually and tested through tabletop and simulation exercises.

Client notification

Clients are notified within 24 hours of us becoming aware of a security incident or data breach affecting their data, by email and phone to the designated contact.

Full incident report

A comprehensive written report, covering root cause, impact, mitigation and corrective action, follows within 72 hours of the initial notification.

Regulatory notification

Where required under UK GDPR, the ICO is notified within 72 hours of a reportable personal data breach; affected individuals are notified without undue delay where there is high risk to their rights.

Where our people are

United Kingdom: primary delivery and client-facing team; all candidate data is stored and processed here.

Additional international support functions handle operational and document processing administration, delivered by dedicated teams working under contract to Giant Screening. Full detail, including location, is set out in our sub-processor register below.

All international connections to UK systems are encrypted and authenticated. No candidate data is stored locally at any international site, and none is replicated outside the UK.

Transfer governance

International transfers are governed by UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs), as appropriate to the destination.

Transfer Impact Assessments have been completed for all international transfers, and a Global Processing DPIA covering our international operations has been completed and approved at Board level.

Pre-employment screening

Conducted in line with BS 7858: identity verification, employment history, financial checks, media and sanctions screening, and criminal record checks where applicable. Staff with access to sensitive data are vetted to at least BS 7858, with re-screening on a recurring cycle.

Ongoing assurance

Mandatory security awareness training at induction, refreshed at least every six months (with some modules quarterly) and reinforced by an annual refresher. All staff are re-screened annually. Confidentiality agreements are a condition of employment, supported by a documented insider threat programme. Employee turnover runs well below the industry average, reflecting a stable, experienced team.

Insurance cover held

Employers' Liability: £10,000,000
Public / Products Liability: £10,000,000
Professional Indemnity: £10,000,000
Cyber Liability: £5,000,000

All policies are current and renew annually with our insurer. Certificates of insurance are available by contacting Customer Success.

Financial position

Giant Screening Limited (company no. 10656083) is a financially stable, independently operating limited company. Statutory accounts are filed at Companies House and publicly available; turnover figures are available by contacting Customer Success. Giant Screening Limited is not part of a private equity portfolio or leveraged buy-out structure.

Track record

No material litigation, disputes or arbitration proceedings in the last three years. No notice of termination for service failure in the last three years. No regulatory enforcement or investigation in the last five years. No personal data breaches reported to the ICO in the last five years.

Audit

An internal audit function reviews compliance with information security policies and the ISMS on a scheduled and unscheduled basis, with findings tracked to resolution and reported to senior management.

Anti-bribery & corruption

A zero-tolerance Anti-Bribery Policy applies across the business, reinforced by mandatory staff training. No confirmed corruption incidents in the most recent reporting year.

Modern Slavery

A Modern Slavery Policy is maintained and applied throughout the business and supply chain. Giant Screening Limited sits below the £36m turnover threshold that would require a statutory Section 54 statement, but holds itself to the same standard regardless.

Environment

ISO 14001 certified. A Carbon Reduction Plan is published in line with PPN 06/21, targeting UK carbon neutrality by 2050.

Diversity & inclusion

Diversity & Inclusion, Equal Opportunities and Anti-Harassment policies are in place. No findings of unlawful discrimination in the last three years.

Whistleblowing

A formal Whistleblowing Policy gives staff and third parties a confidential route to raise concerns, including on information security and ethics matters.

Independent assessment

We hold a current EcoVadis sustainability rating of Bronze, placing us in the top 35% of companies assessed, covering environmental, labour, ethics and procurement practices. Full scorecard available by contacting Customer Success.