Policies & Certificates
Everything a procurement, security or HR team usually asks us for, in one place. No forms, no sales call — just download it.
NetFM UK Limited is registered in England & Wales, company number 08165293, and registered with the Information Commissioner's Office under number ZB049295. If you need something that is not here, email hello@netfm.org and we will send it.
Security & data protection
Security Testing & Penetration Reports
Monthly OWASP ZAP testing, every report published in full, and how to get your own deployment scanned
Information Security Policy
How we protect information across our people, systems and suppliers
Security Overview
Summary of our technical and organisational security controls
Data Security Breach Management Policy
How we detect, contain, assess and report a personal data breach
IT Infrastructure & Data Management Policy
Hosting, access control, change management and backups
Record Management Policy
How records are created, stored, and disposed of
Business Continuity Plan
External continuity and disaster recovery plan
Data Retention Policy
How long we keep data, and who decides — controller vs processor
Privacy Policy
What we collect, why, and what we do with it
GDPR Statement
Your rights and how we handle personal data
Workplace & HR
Our people policies. Short, plain-English, and actually what we do.
Health & Safety Policy
Statement of intent, responsibilities and arrangements — office, home and customer sites
Equal Opportunities & Diversity Policy
Fair recruitment, equal treatment, reasonable adjustments
Anti-Bribery & Corruption Policy
Zero tolerance, gifts and hospitality, third parties — Bribery Act 2010
Whistleblowing Policy
How to raise a concern and how you are protected for doing so
Modern Slavery & Human Trafficking Statement
Our statement on slavery and human trafficking in our business and supply chain
Corporate responsibility
Corporate Social Responsibility Policy
Our commitments to our people, community and suppliers
Environmental Policy
How we manage and reduce our environmental impact
Certifications & insurance
Our Cyber Essentials certification has lapsed — and we would rather tell you than have you find out
Our Cyber Essentials certificate ran to 25 July 2026 and our Cyber Essentials Plus certificate to 8 April 2025. Both are published below as they were issued, expiry dates and all. We have not quietly left them up looking current.
We are happy to complete both Cyber Essentials and Cyber Essentials Plus certification on demand. If either is a condition of working with us — for a tender, a supplier review or a contract renewal — just ask and we will book the assessment. It is a scheduling matter, not a remediation one.
In the meantime our security testing has moved past what an annual certificate measures: we now run monthly penetration testing with OWASP ZAP against our applications, which is a considerably more rigorous and more frequent assessment than the annual Cyber Essentials cycle. We publish every report in full — see security testing, where you can also arrange a monthly scan of your own deployment.
Cyber Essentials Certificate
Whole organisation, profile 3.2 (Willow)
Expired 25 Jul 2026
Cyber Essentials Plus Certificate
Independently audited, whole organisation
Expired 8 Apr 2025
ICO Registration Certificate
Data protection registration ZB049295
Employers Liability Insurance
Certificate of employers liability insurance
Public & Product Liability Insurance
Certificate of public and product liability insurance
Professional Indemnity Insurance
Certificate of professional indemnity insurance
Commercial
Need something else?
We hold further documentation that we share on request — including our penetration test reports, data processing agreement, EULA, SLA, completed security questionnaires and supplier due-diligence packs. Tell us what your procurement process needs and we will turn it around quickly.
Request a document →