Trust & responsibility
Trust & Responsibility
at Decision Focus
We build software that helps regulated industries manage governance, risk and compliance. The same standards we help our clients meet, we hold ourselves to.
This page sets out how. It covers the commitments we live by, the choices we've made, and the things we're working on. We publish what we actually do and where we're heading - not targets written for a framework.

Privacy, security & European sovereignty

You trust us with sensitive risk data. We earn that every day.
Decision Focus is ISO 27001 certified and has an ISAE 3000 assurance report covering SOC 2 trust service criteria. We have a dedicated CISO, a mature information security programme, and a privacy-native architecture.
All client data is hosted in the chosen region of our clients. With Hetzner in Germany for Europe, and AWS for USA and rest of world. Your data stays under the jurisdiction of your choice - it isn't transferred to, processed in, or stored elsewhere.
What we're working on:
Formalising our supplier-assurance process for critical infrastructure providers, anchored on their own independent certifications. Annual review as standard, stronger right-to-audit language in new contracts.
OUR Infrastructure
Our infrastructure footprint
The biggest environmental input of a SaaS business is the energy its servers run on. Ours runs on 100% renewable electricity.
We host with AWS, which is matched to 100% renewable energy across its global operations, and Hetzner, which runs on 100% renewable electricity across its European data centres. Both publish their sustainability data independently, and both are verified to a far higher standard than anything we could produce internally.


How we govern ourselves

Good governance is what we sell, so we practise it.
We operate under a formal Code of Conduct that every employee attests to. We have a whistleblower channel with a clean track record.
Our corporate values are published and used in onboarding, in everyday decisions, and in how we integrate new companies we acquire.
Our board reviews our overall responsibility, security and people posture annually. Our executive team reports on it in our quarterly all-hands. Our incident-response processes are documented and tested.
What we're working on: publishing our Code of Conduct as a standalone document on this site, so it's visible to anyone evaluating working with us - as a client, a partner, or a future colleague.
How we work
Our principles
Our corporate values are published and used in onboarding, in everyday decisions, and in how we integrate new companies we acquire.
1. You are the pilot of your work life
2. Your team comes first
3. Responsiveness
4. Answer before asked
5. Build for the client to succeed – not to their requirement
6. Problem today - capability tomorrow.
7. Fight Dogma
8. Tear down of your own ideas
9. Don’t assume
10. It won’t be pretty
11. Big mistakes = Big ‘gifts’
.png)