How Goldline protects your information.
The certifications we hold, how our platform is run, and the suppliers that process data for us. Policy documents are available on request.
Certifications
Each certificate and supplier registration below is held by Goldline Consultancy Ltd and can be verified with the scheme or body that issued it.
- Certified
Cyber Essentials Plus
Whole organisation. Certified 13 Oct 2026 by Cyluki Security, recertification due 13 Oct 2027.
Certificate 76609075-2896-431b-b3f7-0f9b2808845f - Level 1 certified
IASME Cyber Assurance
Whole organisation, standard v7. Issued 6 Jul 2026, valid to 6 Jul 2027. Level 2 audit in progress.
Certificate c10739e2-c6a2-4a17-9536-cc0ec4d67ca5 - Certified
IASME Quality Principles
Whole organisation, covering consultancy, cyber security, information security and AI governance advisory. Self assessment. Issued 9 Jul 2026, expires 9 Jul 2027.
Certificate 55a0a544-2da1-4c1c-9e95-e9f694c1e294 - Registered supplier
JOSCAR
Registered on the aerospace, defence and security supplier system.
- Supplier
Government Commercial Agency (GCA)
GCA supplier on the Cyber Security Services 3 dynamic purchasing system agreement.
- Accredited supplier
Bloom
Accredited supplier to public sector buyers through Bloom.
- In progress
ISO/IEC 27001:2022
Information security management system in place. Certification by an accredited certification body is planned.
Goldline prepares organisations for assessment. Certificates are issued by accredited certification bodies.
Security controls
The controls below are in place today. The evidence behind each one is available to clients and prospective clients on request.
Identity and access
- Hardware security keys (FIDO2) on every critical account
- Google Advanced Protection enrolled
- Separate administrator accounts for system changes
- Access reviewed quarterly and removed when an engagement ends
Devices
- Full-disk encryption on every laptop
- Firewall blocks all incoming connections, with stealth mode on
- Automatic security updates switched on
- Application allow-listing with built-in malware protection
Platform and hosting
- Hosted on Google Cloud in London, restricted to London by policy
- HTTPS only, TLS 1.2 and 1.3, SSL Labs grade A+
- Only ports 80 and 443 exposed to the internet
- Weekly patching and quarterly security scans
Data protection
- Client evidence held only on the UK-hosted platform or in your own systems
- Article 28 data processing terms wherever client personal data is processed
- Registered with the ICO (ZC189020)
- Nightly backups held in London, with tested restores
Monitoring and response
- Alerts on firewall, access and permission changes
- Weekly review of security alerts and backups
- Written incident process, including 72-hour ICO reporting
- Monthly threat review from named sources
Governance
- Policy set approved and reviewed at least annually
- Risk assessment with a dated treatment plan
- Independent internal audit programme
- Annual management review of the security programme
Policies and evidence
Public documents download straight away. Other documents are shared once Goldline has reviewed your request.
- Cyber Essentials Plus certificateCertified 13 Oct 2026, recertification due 13 Oct 2027PublicDownload
- IASME Cyber Assurance Level 1 certificateIssued 6 Jul 2026, expires 6 Jul 2027PublicDownload
- IASME Quality Principles certificateIssued 9 Jul 2026, expires 9 Jul 2027PublicDownload
- General Terms of Business v1.0Contract terms, including confidentiality and data processingPublicDownload
- Privacy noticeHow Goldline handles personal dataPublicDownload
- Information Security PolicyTop-level policy, approved by the DirectorOn request
- Acceptable Use and Remote Working PolicyDevices, accounts, AI agents, premises and travelOn request
- User Access Control PolicyAccount lifecycle, least privilege and two-step sign-inOn request
- Data Protection PolicyUK GDPR roles, processing terms and breach reportingOn request
- Incident Management PolicyDetection, response, notification and lessons learnedOn request
- Business Continuity and Disaster Recovery PlanRecovery targets and the tested restore processOn request
- Backup PolicyWhat is backed up, where, and how restores are testedOn request
- Data Retention ScheduleRetention periods and secure deletionOn request
- Firewall and Network Boundary PolicyDevice, office, home and cloud boundariesOn request
Sub-processors
| Supplier | Purpose | Location |
|---|---|---|
| Google Cloud (Google Cloud EMEA Limited) | Hosts the Goldline platform, restricted to London by organisation policy | London, UK |
| Google Workspace (Google Cloud EMEA Limited) | Business email, documents and calendar. Client evidence is not held here | Europe |
The full sub-processor list, with data processing terms, is available on request.
Practitioner credentials
Goldline's work is delivered by its director, Alfred Obeng: CISSP and PMP, with these PECB certifications. Select a badge to verify it on Credly.
Report a security concern
If you think you have found a vulnerability or a security problem affecting Goldline, tell us directly.