Your data is protected by the same standards enterprise customers demand
Installer accounts, customer details, MPANs, documents and payments are all handled on infrastructure certified to SOC 2 Type II and ISO 27001, with UK GDPR built into how we run the business.
Certifications & compliance
SOC 2 Type II
Our infrastructure provider is independently audited to SOC 2 Type II, the recognised standard for how a technology platform handles customer data, access controls and operational security.
ISO 27001
The platform we're built on holds ISO 27001 certification, the international standard for information security management systems.
UK GDPR Compliant
We operate under UK GDPR. A Data Processing Agreement is available on request, and every installer can export or delete their own data at any time from their account.
PCI DSS Payment Processing
All card payments are processed by Stripe, which is PCI DSS Level 1 certified, the highest level available. We never see or store card numbers.
SOC 2 Type II and ISO 27001 certifications are held by the platform we operate on. DNO Renewables Ltd operates in compliance with UK GDPR and holds ICO registration.
How we protect your data day-to-day
Encrypted at rest and in transit
Every application, document and message is encrypted using industry-standard protocols, both while it's being sent and while it's stored.
Row-level access control
Installers only ever see their own applications. Access rules are enforced at the database layer, not just in the UI, so data can't leak between accounts.
Regular penetration testing
The underlying platform runs both internal and third-party penetration tests and operates a public bug bounty programme for responsible disclosure.
Hosted on enterprise-grade infrastructure
We run on a hardened, monitored cloud platform with automated security scanning, subprocessor transparency, and 24/7 availability monitoring.
Your rights under UK GDPR
- Access & portability. Every installer can download a full JSON export of their account and applications from their dashboard at any time.
- Erasure. One-click account deletion clears your personal details and anonymises submitted applications, no email request needed.
- Data Processing Agreement. Available for installers who need one signed for their own records. See below.
- Transparent processing. Our Privacy Policy lists exactly what we hold, why we hold it, and how long we keep it for.
Questions about how we handle your data? Email info@dnorenewables.co.uk.