How we handle your data
Deviant Botanicals Limited (DevBot) and ambivalence are built with public sector procurement in mind. Cyber Essentials certified, EU-hosted, UK GDPR-compliant, aligned to recognised frameworks — and plainly documented, because "trust us" is not an answer an information governance team accepts.
Cyber Essentials
Deviant Botanicals Limited is certified under Cyber Essentials, the UK Government-backed scheme run by the National Cyber Security Centre. It checks the five technical controls that stop most common attacks: firewalls, secure configuration, user access control, malware protection and security update management.
Central government asks for it of suppliers who handle personal information, and many councils ask for it at procurement. The badge is verified live by Blockmark. View the certificate →
Data hosting & residency
All platform data (learner progress, credential assertions, analytics, tenant configuration) is stored on IONOS servers in Germany, inside the European Economic Area, which UK law recognises as adequate for personal data.
Traffic reaches those servers through Cloudflare, normally via its London data centre; it carries traffic in transit and stores no learner records. Reflections are scored in the learner's own browser, not by a third-party AI service, so no learner personal data leaves the UK and EEA in normal operation.
UK GDPR compliance
We process personal data under the UK GDPR and the Data Protection Act 2018, collect the minimum, keep only what the service needs, and support every data subject right: access, rectification, erasure, portability, restriction and objection.
A Data Processing Agreement is part of every institutional licence, and you can review our draft before you commit.
Security posture
Cyber Essentials certified, aligned to the NCSC 14 Cloud Security Principles and benchmarked against ISO 27001 and the NHS DSPT.
- TLS 1.2 or later from the browser to our servers
- A database reachable only from inside the server
- Salted bcrypt password hashes; least-privilege access
- Nightly backups, each test-restored, with an encrypted off-site copy
- The last five releases kept, so any deploy can be rolled back
- No card data stored; licensing is invoiced
Credential integrity
Open Badges 3.0 credentials are signed with an Ed25519 key published in our issuer profile. Each lives at a permanent public verify URL where anyone can confirm it is genuine and unrevoked, without an account or a subscription. Credentials never expire.
We are moving the signature to the standard eddsa-rdfc-2022 Data Integrity format so third-party OB3 verifiers and wallets can check it too.
Infrastructure partners
IONOS provides primary hosting from ISO 27001-certified data centres; ambivalence runs in its German data centre, behind Cloudflare's network.
Transactional and marketing email goes through established UK and EU SMTP providers, never unregulated third-country relays.
Accessibility
We target WCAG 2.2 Level AA, and are partially compliant at the last review. Full keyboard navigation, WebVTT subtitles on episode video, and a built-in panel (Alt + A) for text size, high contrast and reduced motion.
Read the accessibility statement →Documentation on request
For procurement, information governance or security review, we can share:
- Data Processing Agreement — draft for review, executed with each licence
- Security Architecture Whitepaper — NCSC Cloud Principles mapping (draft)
- Incident Response Plan — roles, timelines, notification thresholds (draft)
- Service Level Agreement — uptime, support tiers, service credits (draft)
- Terms of Service & Privacy Policy — drafts awaiting final legal review
- Cyber Essentials certificate — verifiable online through Blockmark
- Research & Comparator Matrix — evidence base for NCSC, ISO 27001 and NHS DSPT alignment
Send us your questionnaire
Security questionnaires, DPAs, data residency or specific compliance questions: email hello@dev-bot.co.uk with "Security & Trust Enquiry" in the subject. We aim to reply within two working days.