Bright is Cyber Essentials Plus certified and aligned to ISO 27001, with UK and Irish customer data hosted in ISO 27001 and SOC 2 certified data centres in Europe. Here is how we protect the payroll, accounts and tax data you trust us with, and where to find the documents your procurement team will ask for.
Independent Cyber Essentials Plus certification, and an annual audit by our investor, Hg, aligned to the NIST Cybersecurity Framework.
Hosted in certified data centres
ISO 27001 and SOC 2 certified public cloud infrastructure, in European regions for UK and Irish customers.
Encrypted by default
Data protected in transit and at rest, with encryption keys held in a secure key vault.
Monitored around the clock
A Security Information and Event Management (SIEM) system runs 24/7 with automated anomaly alerts.
HOSTING AND RESIDENCY
UK and Irish customer data stays in European data centres.
Bright’s cloud products run on Microsoft Azure and Amazon Web Services (AWS), with UK and Irish customer data hosted in European regions: the EU (Ireland) or the UK. Where applicable, US, Indian and Australian client data is hosted in its own jurisdiction.
Under the cloud shared-responsibility model, the provider secures the data centres themselves: the physical buildings, environment and underlying compute. Bright secures everything we deploy on top: our applications and how the infrastructure is configured.
Microsoft Azure: BrightPay and Bright’s other cloud products, apart from those on AWS (below), are hosted in ISO 27001 / SOC 2 certified Microsoft Azure datacentres.
Amazon Web Services (AWS): BrightWorkpapers (UK, EU and Australian regions) and BrightTax (UK region).
Continuous posture checks: cloud-native tooling assesses our infrastructure against industry benchmarks, including the Centre for Internet Security (CIS) benchmarks.
CERTIFICATIONS
What is certified, and what is audited.
Cyber Essentials Plus
Bright Software Group is independently certified under the UK government-backed Cyber Essentials Plus scheme.
ISO 27001: Bright is aligned to ISO 27001, and all customer data is hosted in ISO 27001 certified data centres.
SOC 2: our cloud hosting providers’ data centres hold their own SOC 2 certification.
Annual audit: Bright has an annual security audit by our investor, Hg, aligned to the NIST Cybersecurity Framework.
ACCESS AND ENCRYPTION
Only the right people get in, and data stays encrypted.
Two-factor authentication for your team
Bright products support two-factor authentication (2FA) through BrightID, the same for every product: an authenticator app is the recommended method, with email codes also available. For employees using BrightPay’s self-service portal, 2FA is optional but recommended.
Encryption in transit and at rest
In transit: HTTPS is mandatory, with a minimum of TLS 1.2 and the strongest SHA-256 cipher suites prioritised.
At rest: transparent data encryption on every database, with keys held in a secure key vault.
Passwords: stored only as salted one-way hashes, never in plain text.
How Bright staff access systems
Multi-factor authentication (MFA): enforced for staff wherever possible, with authenticator apps preferred; SMS is disabled as a second factor for corporate access.
Conditional access: policies restrict who can sign in to Bright systems, and from where.
Managed devices: every corporate device is centrally managed, with disk encryption, an always-on firewall and Endpoint Detection and Response (EDR).
Separate networks: the corporate network is physically and logically separate from customer application infrastructure.
Security training: regular security awareness training and phishing exercises for all staff.
SECURE DEVELOPMENT
Security is built into every release.
Every Bright customer application is developed in-house, under a defined Secure Software Development Lifecycle (SSDLC).
OWASP Top 10 training
Developers trained on the most common web application vulnerabilities.
Third-party libraries continuously tracked for vulnerabilities, and updated on a regular cadence.
Vulnerability scanning and penetration testing
Both run continuously via independent 3rd party providers.
RESILIENCE
Protected against attack, and open about service status.
DDoS protection
Industry-standard tooling guards against Distributed Denial of Service (DDoS) attacks.
Threat intelligence
Multiple threat-intelligence feeds inform our guidance and policy on emerging threats.
Email authentication
SPF, DKIM and DMARC records are in place, helping protect you from phishing emails that pretend to be from Bright.
Live service status
Check the current status of every Bright product, and subscribe to incident updates, at status.brightsg.com.
PRIVACY AND GDPR
Built to meet UK data protection law.
Bright complies with UK data protection law, including the UK GDPR and the Data Protection Act 2018, and maintains an up-to-date registration with the Information Commissioner’s Office (ICO).
We never sell or rent your data. We share it only with the third-party subprocessors that help deliver our services, each contractually bound to equivalent security standards.
No documents match. Try another word or clear the filters.
FAQS
Security questions, answered.
Is Bright ISO 27001 certified?
No. Bright is aligned to ISO 27001, and all customer data is hosted in ISO 27001 certified data centres. Bright Software Group is Cyber Essentials Plus certified.
Where is my data stored?
UK and Irish customer data is stored in Microsoft Azure and Amazon Web Services (AWS) datacentres in European regions: the EU (Ireland) or the UK. See GDPR and data residency for the detail.
Is my data encrypted?
Yes, data is encrypted in transit over HTTPS (minimum TLS 1.2) and at rest with database encryption.
Does Bright support two-factor authentication?
Yes, Bright products support two-factor authentication, with an authenticator app as the recommended method.
Where can I get Bright’s Data Processing Addendum?
