Our company certifications
Certified in quality and information security
Blocworx is certified to ISO 9001 for quality management and ISO 27001 for information security. These certifications support how we run our business, deliver our services and protect information.
ISO 9001
Quality management
Request certificate for ISO 9001
ISO 27001
Information security
Request certificate for ISO 27001Security built into how we work
Our information security management system sets out how we protect information, assess risks and improve our practices. It covers our people, the Blocworx platform and the services we provide.
Access with a clear purpose
Access is based on each person’s role and the work they need to do. Our procedures cover approvals, reviews, changes and removing access when someone leaves. Multi-factor authentication protects privileged and administrative access.
Protecting your information
Our policies cover encryption for information in transit and at rest, secure handling of credentials and clear rules for storing, sharing and disposing of data.
Backups and recovery
Customer data is hosted on AWS in its EU West region in Ireland. We use Acronis for backups of customer data and EC2 instances, hosted in Ireland. Our recovery procedures cover restoring services and testing recovery arrangements.
Careful changes to software
Our development process includes security checks, testing and controlled releases. We assess risks when changing software, infrastructure or the way information is handled.
A plan when something goes wrong
Our incident procedures cover reporting, assessment, response and service recovery, including customer communication where required. We record what happened and use the findings to improve.
People and suppliers
Staff responsibilities, training and confidentiality are part of our security processes. We assess suppliers according to the service they provide and the information they may handle.
Independent penetration testing
Penetration test completed with CommSec
Blocworx has completed a penetration test with CommSec. This independent testing forms part of how we assess the security of our software.
The report is available for review on request, subject to confidentiality arrangements.
Request access to the penetration test reportWe use our own system
We manage our own quality and information security work in Blocworx. Policies, training, internal audits, incidents and improvement actions can be kept alongside the records that show the work being done.
That same connection is central to Blocworx Quality Management for our clients: an operational system and a quality management system working together.
Security documents and certificates
Reviewing Blocworx as a supplier? Request the documents you need below. Our team will confirm the appropriate version and any confidentiality requirements before sharing. A request does not give automatic access.
Certificates and assurance
- ISO 9001 certificateRequest access to ISO 9001 certificate
- ISO 27001 certificateRequest access to ISO 27001 certificate
- CommSec penetration test reportRequest access to CommSec penetration test report
- ISMS Statement of ApplicabilityRequest access to ISMS Statement of Applicability
Key policies and procedures
- Information Security PolicyPOL025Request access to Information Security Policy
- Security and Access Control PolicyPOL014Request access to Security and Access Control Policy
- Data Protection and Privacy PolicyPOL008Request access to Data Protection and Privacy Policy
- IT / Cybersecurity PolicyPOL015Request access to IT / Cybersecurity Policy
- Cryptography PolicyPOL027Request access to Cryptography Policy
- Project and Secure Development Lifecycle PolicyPOL005Request access to Project and Secure Development Lifecycle Policy
- Supplier / Purchasing PolicyPOL012Request access to Supplier / Purchasing Policy
- Business Continuity, Backup and Recovery ProcedurePRO016Request access to Business Continuity, Backup and Recovery Procedure
- Incident Management and Service Recovery ProcedurePRO011Request access to Incident Management and Service Recovery Procedure
- Record Retention and Disposal ProcedurePRO023Request access to Record Retention and Disposal Procedure
Our subprocessors and service providers
We use the following providers to deliver our software and run our business. Providers handling customer personal data on our behalf act as subprocessors for the relevant service. The services involved depend on your setup and the features you use. Our customer agreements define the processing that applies to your service.
Customer services and infrastructure
Amazon Web Services (opens in a new tab)
Hosting of customer data and the Blocworx platform.
AWS EU West (Ireland) for our main customer-data hosting.
Acronis (opens in a new tab)
Backups of customer data and AWS EC2 instances.
Our Acronis backups are hosted in Ireland.
Phonovation (opens in a new tab)
SMS messages sent through supported Blocworx processes.
Used when SMS is enabled for the service.
MailerSend (opens in a new tab)
Email delivery and inbound email routing.
Handles message content, email addresses and delivery information where these features are used.
VMotion (opens in a new tab)
Additional data hosting for specific customers.
Used where a customer’s service has a separate hosting arrangement.
Microsoft Azure (opens in a new tab)
Hosting applications that connect with a customer’s Microsoft environment.
Used for relevant integrations; the deployment and hosting region depend on the agreed service.
Internal business services
These tools support our own business. They can also hold personal data in correspondence, documents or support records, depending on the work involved.
Google Workspace (opens in a new tab)
Internal email, documents and team collaboration.
May contain business contacts, correspondence and support information.
Atlassian (opens in a new tab)
Internal project, development and work tracking.
May include support records and customer information needed to manage that work.
Blacknight (opens in a new tab)
Domain, DNS and hosting services for our internal business needs.
Handles the business and technical information needed to provide these services.
For questions about a provider, a hosting arrangement or your data processing agreement, contact our team.
Have a security question?
Tell us what your team needs to review. We can help with security questionnaires, document requests and questions about your service.
