Data security principles for Sage.com

Our dedicated global team is responsible for cyber security at Sage. These security specialists stay up to date on changes by achieving and maintaining recognized industry certifications. We also keep in contact with external bodies, such as national cyber security authorities and privacy regulators. Our senior executives regularly discuss cyber security and are ultimately accountable for security at Sage.

Reference, credit, and criminal record checks are done for new employees and for necessary roles. Our employment contracts include information security requirements to ensure every employee adheres to our security protocols. We also provide rigorous security training to all our employees to make sure they understand and can spot and report risks and security challenges effectively.

We keep track of the different types of data that we handle so that we can ensure it is properly protected. By recording data across all software applications, computers, and IT systems, we can effectively track it. And we ensure that protection we use is proportionate to the sensitivity of the data—more sensitive data has extra controls.

We apply rules to control which Sage employees can access customer data. We only allow our employees to access customer data if it is needed for them to do their job, for example, to provide technical support. We log and record all employees that have access to customer data.

Encryption is a way of scrambling data to help keep it secure. We often use encryption to protect our customers’ data, for example where is being sent over the internet. We issue clear guidelines written by our security specialists for how our employees should use encryption. We make sure that we properly protect passwords and the keys that can be used to read encrypted data.

We use a variety of techniques to help stop security problems being introduced into our software as it is being written, and to find and fix problems before we make our software available for customers to use. All Sage employees involved in writing Sage software are trained in these techniques.

We use a variety of software and hardware tools to make sure that unauthorized people can’t access our customers’ data over the internet or via computers. We keep our IT systems up to date and run specialist security tools on them to detect attacks and prevent them becoming infected by viruses or other malicious software.

We use specialist tools to scan computer hardware and software on a regular basis to look for weaknesses that could potentially lead to security problems. If we find these weaknesses, we fix them on a priority basis. Despite adopting industry best practices, security problems can still happen. When they do, we have clear internal processes to ensure issues are quickly reported and handled by the relevant people. After a problem is fixed, we learn from what happened to try to stop it from happening again.

We store and process our customers’ data in secure data centres (usually in the cloud). These data centres are secure and access is restricted to those with appropriate permission. They are also built to be able to withstand fire, flood, lightning strike, power outages or other similar events. As an additional precaution, we often store customers’ data in multiple data centres so that, if one is out of action, our products will keep working.

We use third-party companies across our business. Some of these companies handle our customers’ data on behalf of Sage. Before we send data to any third-party, we review their approach to information security to make sure that we only rely on companies with good security standards and ensure that we have relevant contractual protections in place.