Built for important documents
Documentd and Keepd are designed around security, privacy and long-term availability. Our information-security controls are independently assessed, we support customers operating in regulated sectors and jurisdictions, and recipients keep their own private copies of the documents delivered to them.
Independently certified and assessed
StayPrivate operates an information security management system independently certified to ISO 27001 and holds Cyber Essentials Plus certification.
Security
Layered technical and organisational controls protect documents and information throughout their lifecycle.
Privacy
Documentd and Keepd are not built around advertising, profiling or exploiting personal information.
Recipient ownership
Recipients receive their own copy in Keepd, under their control and independent of the organisation that sent it.
Resilience
Our infrastructure and operational processes are designed to protect important information and keep it available.
Security by design
Important documents require more than a secure login. Documentd and Keepd use layered technical and operational controls to protect information throughout its lifecycle.
Encryption
Documents are encrypted individually before storage. Decryption keys are not stored, and StayPrivate personnel cannot independently decrypt customer documents.
Access control
Access to systems and information is restricted according to operational need and limited to authorised personnel.
Secure infrastructure
Documentd and Keepd operate on professionally managed cloud infrastructure designed for security, resilience and scalability.
Environment separation
Production systems are separated from development environments, with access and configuration governed through our information-security processes.
Monitoring and maintenance
Systems and dependencies are monitored and maintained, with security vulnerabilities assessed and addressed according to risk.
Authentication
Recipients access their Keepd through authenticated accounts rather than permanently accessible public document links.
Security controls independently assessed
ISO 27001
StayPrivate operates an information security management system certified to ISO 27001.
ISO 27001 provides a structured framework for identifying information-security risks, implementing appropriate controls and continually reviewing and improving those controls.
Cyber Essentials Plus
StayPrivate also holds Cyber Essentials Plus certification.
Cyber Essentials Plus adds independent technical verification to the Cyber Essentials framework, providing external assurance that important technical protections are operating effectively.
Additional security testing
We carry out additional internal security testing as part of the ongoing development and operation of Documentd and Keepd. This includes targeted testing when systems, features or potential vulnerabilities warrant further investigation.
G-Cloud supplier
StayPrivate services are available through the UK Government's G-Cloud framework, supporting procurement by public-sector organisations.
Built for regulated information
StayPrivate maintains security, privacy and contractual controls designed to support customers operating in regulated environments. Where a regulation applies directly to StayPrivate as a processor or service provider, we maintain the relevant arrangements. Where the obligation sits with our customer, Documentd is designed to help that customer meet its own delivery, security and supplier-assurance requirements.
GDPR and processor obligations
StayPrivate operates in accordance with its applicable obligations under the UK GDPR and Data Protection Act 2018 and supports processing under the EU GDPR. Where StayPrivate processes personal data on behalf of a customer, appropriate processor agreements and sub-processor protections are maintained.
Our technical and organisational measures include individual document encryption, restricted access, permanent audit histories, data minimisation, controlled retention and deletion, business continuity and regular security assessment.
Support for HIPAA-regulated use
Where StayPrivate processes protected health information on behalf of a HIPAA Covered Entity or Business Associate, StayPrivate can operate as a Business Associate and enter into an appropriate Business Associate Agreement.
StayPrivate has assessed its controls against the administrative, physical and technical safeguards of the HIPAA Security Rule. Business Associate Agreements and supporting security information are available to qualifying healthcare customers as part of their due-diligence process.
Regulated customer communications
Documentd is designed to support financial-services firms that need to deliver important customer communications securely and in a form the customer can retain and access for future reference.
This can support firms where FCA rules require information to be provided on a durable medium, and can complement firms' Consumer Duty processes around consumer understanding and consumer support. The regulated firm remains responsible for determining which rules apply to each communication and for its own regulatory compliance.
Our independent security assurance, auditability, controlled retention, business continuity and supplier-security documentation are also intended to support financial-services procurement and third-party risk reviews.
Customer-information safeguards
For US financial-services customers, StayPrivate's administrative, technical and physical security controls are designed to support supplier due diligence relating to protection of customer information, including requirements arising under the Gramm-Leach-Bliley Act and applicable Safeguards Rules.
For broker-dealers, investment advisers, investment companies, transfer agents and other institutions subject to SEC Regulation S-P, we can provide information about our safeguards, incident management, access controls, encryption, retention and sub-processor arrangements to support the firm's service-provider assessment.
CCPA / CPRA service-provider controls
StayPrivate supports organisations subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
Where StayPrivate processes personal information on a customer's behalf as a service provider or contractor, our contractual and operational controls restrict its use to the agreed business purposes and the operation of the service. StayPrivate does not sell customer personal information or share it for cross-context behavioural advertising.
The recipient's copy belongs with the recipient
Documentd differs fundamentally from a conventional customer portal. A business uses Documentd to deliver an important document. The recipient receives their copy through Keepd, their personal place for the things they want to keep.
That copy is not simply a temporary window back into the sender's system. The recipient can continue to keep and access it independently of the organisation that originally delivered it.
The sender remains responsible for its own records and systems. Keepd gives the recipient somewhere for their own copy.
Private to the individual
A Keepd account belongs to its user. Documents delivered by different organisations can sit alongside documents, files, emails, notes and other things that the individual chooses to keep for themselves.
Businesses using Documentd do not gain access to the rest of a recipient's Keepd. One organisation cannot see documents delivered by another organisation simply because both use Documentd.
Built to provide the service, not to exploit the data
Documentd is not built around advertising, profiling or exploiting personal information. Information entrusted to Documentd and Keepd is used to provide and operate the services for which it was supplied.
We aim to collect and retain only the information needed to deliver those services, operate them securely and meet our legal obligations.
Designed for long-term availability
Important documents are often needed long after they were first delivered. Documentd and Keepd are therefore designed around durability as well as immediate delivery.
Our systems incorporate backup, recovery and operational-resilience measures intended to protect against loss and maintain availability. We regularly review risks affecting the confidentiality, integrity and availability of information through our information security management system.
Privacy built into how we operate
StayPrivate operates Documentd and Keepd with data protection and privacy built into their design.
Where Documentd is used by an organisation to process personal information on its behalf, appropriate contractual and data-processing arrangements are available, including UK and EU GDPR processor terms, CCPA / CPRA service-provider provisions and HIPAA Business Associate Agreements where applicable.
Supporting your due diligence
Organisations in regulated and security-sensitive industries may need to conduct their own due diligence before using Documentd.
We can provide additional assurance information as part of an appropriate enterprise evaluation.
The business sends. Documentd delivers. The individual keeps.
Security protects the journey. Privacy protects the individual. Keepd gives the recipient a place for their own copy that does not depend on continuing to use the organisation that originally sent it.
Talk to us about Documentd
If you are considering Documentd for large-scale or regulated document delivery, talk to us about security, privacy, compliance or technical integration.