SECURITY
Your records, protected
ISO/IEC 27001:2022 certified by the British Assessment Bureau and hosted on AWS. The detail IT, security and procurement teams ask for, in one place.
Independently certified, not self-assessed
Papertrail has been certified by the British Assessment Bureau since 7 May 2022, most recently reissued 29 May 2026 and valid until 6 May 2028, subject to annual assessments. The certificate is ISO/IEC 27001:2022, the current version of the international standard for information security management.
Built on infrastructure made for scale
Papertrail runs on Amazon Web Services, with the redundancy and availability AWS provides.
GDPR and data handling
Papertrail is a UK company (Kit Log Limited, registered in England and Wales) and is subject to UK GDPR.
Personal data is retained for five years, unless a longer legal or regulatory obligation applies, or you ask us to continue holding it.
Some of the service providers we work with, including AWS, sit outside the UK and EU: those transfers are protected under approved data protection mechanisms.
Common questions
Is the ISO 27001 certification independently audited, or self-assessed?
Independently audited, by the British Assessment Bureau, an accredited third-party awarding body, not a self-declared claim.
Where is Papertrail hosted?
On AWS.
Do you offer a signed Data Processing Agreement (DPA)?
There's no separate agreement to sign. Our data processing terms are part of our terms and conditions (clause 15, Data Protection), which every customer accepts, and our Privacy Policy sets out how we handle personal data.
How long is data retained?
Five years, unless a longer legal or regulatory obligation applies, or you ask us to continue holding it. See our Privacy Policy for full detail.
Independently certified. Built to be checked.
Book a demo and we'll walk through it with your own equipment.
26 million inspections recorded· No obligation.
Last reviewed on . MJB.