Trust Center. What your security team will ask.
How AwardScience protects your programme data, where it is hosted, who processes it, and what we do and do not hold. Written for the security, privacy and procurement teams who review us.
Request our security packSecurity at a glance
The controls that protect every programme on AwardScience, on every plan.
Encrypted everywhere
All data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Encryption keys are held in a managed key service in your own hosting region.
Controlled access
Multi-factor authentication and role-based, least-privilege permissions throughout. Administrative access is limited to named staff and every session is logged.
Tested resilience
Deployed across multiple availability zones, with a recovery copy in a second region of the same geography. Our disaster recovery exercise includes a full region failover, with recovery measured inside our targets.
Safe file uploads
Every uploaded file is quarantined and scanned for malware before anyone can open it, including judges and administrators. Clean files are served only through time-limited links.
Documents and policies
Public pages you can read now, and the documents we share with enterprise customers during evaluation.
Subprocessor register
Every third party that processes customer data, what it does, where, and under which safeguard, with a map of hosting regions.
Read the register →Responsible AI
Every AI feature and the data it sees, mandatory human review, and our commitment that no customer data trains any model.
Read our AI principles →Privacy notice
How personal data is collected, used and protected across AwardScience.
Read the notice →Data Processing Agreement
A DPA incorporating the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments, for enterprise customers.
Security documentation
Our information security policy set, disaster recovery and business continuity test results, and a completed security questionnaire.
Terms and conditions
The terms that govern use of AwardScience.
Read the terms →Certifications
What we are working towards, and what we inherit from our infrastructure. We would rather be precise than impressive.
Our certification programme
KYWH Limited is working towards ISO/IEC 27001 certification, targeting May 2027. Our information security programme is documented across a full policy set and built around the ISO/IEC 27001 control domains.
Our infrastructure
AwardScience runs on Amazon Web Services, which holds ISO/IEC 27001 and PCI DSS certifications for the infrastructure we use.
Privacy law
Built for GDPR and UK GDPR obligations through our DPA and transfer safeguards, and operated in line with the Hong Kong Personal Data (Privacy) Ordinance.
Security questions
The questions security and procurement teams ask us most.
Reviewing us for your organisation?
Ask for the security pack.
Our policy set, disaster recovery test results and security questionnaire are available under NDA for enterprise evaluations.