53 controls monitored continuously with Sprinto
Verified in our Trust Center
Trusted by 300+ organisations, including NYAS, Oxford University NHS Trust, Citizens Advice and RAF Museum.
Key facts for security, IT and data protection reviews.
Evidence for each item below is available in our Trust Center.
Volunteero runs on Amazon Web Services in Ireland.
All customer data is stored in the EU, in AWS data centres in Ireland.
Databases are not reachable from the public internet. Only Volunteero’s own services can connect to them.
We run with extra capacity across multiple data centres, so the service does not depend on any single one.
Network connections are limited to those that are needed, and capacity and performance are monitored.
Data is encrypted at rest and in transit.
Access to production systems is limited to the people who need it.
Access is granted under our Access Control Policy and removed when someone leaves the company.
Everyone with access to production systems must use a strong password and two-factor authentication.
Changes to production systems are approved before they are released.
Assets, roles and responsibilities are documented and reviewed by management.
Your administrators decide who can see and do what in Volunteero.
Role-based permissions for every staff user, including access to sensitive information
Group restrictions that limit each person to the data within their remit
Single sign-on (SSO) for staff and volunteers
Multi-factor authentication, enforceable for staff and volunteers
Optional app lock with biometrics or a PIN
A full audit trail, with all activity logged against the relevant records
Administrators can remove a user’s access at any time
See compliance features in Volunteero
We log activity across our infrastructure and follow documented procedures when something goes wrong.
All requests to our load balancers, servers and databases are logged and monitored for suspicious activity.
Security event logs are collected centrally, and anomalous behaviour is flagged for review.
Incidents are handled under our Incident Management Policy and Procedure.
Breach notification procedures cover personal data and protected health information.
We test our defences regularly and plan for disruption.
Security is part of how our team works every day.
Security and privacy training when people join and at regular intervals afterwards
Staff acknowledge our policies when they join and periodically, and follow a Code of Business Conduct
Company devices are protected with full-device encryption and anti-malware
Third-party and vendor risks are assessed and reviewed by management
Risks are assessed and managed under our Risk Assessment & Management Policy
We process personal data in line with GDPR.
Personal data is hosted in the EEA.
We never sell your data. It is only processed by the providers needed to run Volunteero and the services you choose to use, such as DBS checks with Verifile.
Data Protection Impact Assessments for relevant processing
An EU Representative and a Chief Privacy Officer
Support for data subject access requests, choice and consent
Data retention, privacy by design and breach notification policies
You can export your data at any time.
Our Trust Center holds 37 policies and 4 documents. Key items include:
ISMS Manual
Technical and Organisational Measures
Cyber Essentials certification
Information Security Policy
Data Protection Policy
Encryption Policy
Access Control Policy
Incident Management Policy
Business Continuity & Disaster Recovery Policy
View all documents in our Trust Center
Where is our data stored?
All data is hosted on Amazon Web Services in Ireland, so it stays in the EU. Our databases are not accessible from the public internet, and data is backed up every hour.
Is Volunteero GDPR compliant?
Yes. Volunteero is GDPR compliant and hosts all personal data in the EEA. We support data subject access requests, carry out data protection impact assessments and have an EU Representative and a Chief Privacy Officer.
Is Volunteero HIPAA compliant?
Yes. Volunteero is HIPAA compliant, with safeguards for protected health information and a dedicated breach notification procedure for health data.
Is Volunteero Cyber Essentials certified?
Yes. Volunteero holds Cyber Essentials certification. You can view our certification and supporting documents in our Trust Center.
How is our data encrypted?
Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Passwords are encrypted, and our team can’t see or change them.
Can we use single sign-on and multi-factor authentication?
Yes. Volunteero supports single sign-on for staff and volunteers, and you can enforce multi-factor authentication. Volunteers can also lock the app with biometrics or a PIN.
How do you test and monitor security?
We run independent penetration tests twice a year and monitor 53 security controls continuously with Sprinto. All requests to our servers and databases are logged and monitored, and we follow documented incident management procedures.
