Trust and security, verified
Everything your security and procurement team needs to evaluate Disciple (certifications, data residency, sub-processors and data rights) in one place, with the live evidence a click away.
Certified, GDPR compliant
Data residency, chosen at onboarding
No lock-in, no exit fee
DPAs and sub-processor lists
01
Certifications
Certified. Verifiable.
ISO 27001
ISO 27001 certified
Certified to the international standard for information security management by an IAS-accredited certification body, and re-verified annually through surveillance audits.
GDPR
GDPR compliant
Founded in London over a decade ago, Disciple was built with GDPR compliance from the start, not retrofitted later.
02
Infrastructure & hosting
Where it lives, how it's protected
Hosting
EU or US, your choice
Choose the region your community lives in when you onboard. Your data remains within that region for the duration of your contract.
Infrastructure
Enterprise cloud providers
Built on established cloud infrastructure, with encryption applied to data both in transit and at rest.
Third parties
Region-bound, with limited exceptions
Your community data is hosted in the AWS region you choose — US or EU. A few underlying services, or integrations like Zapier, may process data outside that region.
Data separation
Separate by default
Each customer's data is separated into its own dedicated database.
Testing
Independently tested
We regularly engage a CREST-accredited security firm to assess the platform for vulnerabilities, with fixes applied as soon as they're identified.
Backups
Encrypted, redundant backups
Data is backed up daily and encrypted at rest, with database redundancy across multiple availability zones to protect against failure.
03
Sub-processors
Full visibility, nothing hidden
Documentation
DPAs on request
A data processing agreement covering how we handle your data is available on request — standard practice for enterprise and nonprofit procurement alike.
Full list
Every sub-processor, published
Every third party with access to your data is listed, along with what they do and where they operate.
View the full list04
Data rights
Your data, your exit ramp
Export
Full data export, anytime
Members, posts, and analytics export in full whenever you ask for them.
Deletion
Members control their own data
Members can request export or deletion of their personal data at any time, in line with GDPR.
No lock-in
Leave with everything, no exit fee
If you ever decide to leave, you take your member data, content, and analytics with you — in full.
05
Reliability
Reliable, and accountable
Uptime
99.95% uptime target
We target a minimum of 99.95% app uptime year-round, as set out in our Terms of Service.
Incident response
Clear commitments if something goes wrong
In the event of a data breach, we notify you without undue delay and assist with your own GDPR notification obligations.
What's in the Trust Centre
The Trust Centre covers security compliance, infrastructure safety, data privacy, organizational controls, and certifications — showing exactly how we protect your community and your members' data.