Security Compliance and Resilience

2 min read

0:00 3:48

Doc Summary

Effective date: January 1, 2026

This page provides a complete overview of Accept Mission’s security compliance approach, incident handling, and resilience practices. It is written for customers that need a clear, high-level explanation for internal security reviews.

1) ISO 27001 #

Accept Mission is ISO 27001 certified.

What ISO 27001 means in practice #

ISO 27001 is an international standard for Information Security Management Systems (ISMS). It requires a structured security management approach that includes Risk assessment, controls selection, continuous improvement, internal audits, and independent certification audits.

Certification scope and details #

ISO 27001 certification always applies to a defined scope. If you need the certificate and scope statement for procurement or audit purposes, contact us and we will provide:

Certification body (issuer)
Certificate identifier
Validity dates
Scope statement (which parts of the organization, processes, and services are covered)

Contact route: [email protected]

2) Security incident handling #

How incidents are handled #

Accept Mission follows a defined incident response process designed to identify, contain, eradicate, recover, communicate, and document security events. This process includes:

Detection and triage: assess signals from monitoring and internal reports to determine severity and impact.
Containment: isolate affected systems or accounts to stop further impact.
Investigation: determine root cause, affected data, and the timeline of events.
Remediation: patch vulnerabilities, rotate credentials, update rules and configurations, and harden controls.
Recovery: restore services safely and validate system integrity.
Post-incident review: document findings, corrective actions, and prevention improvements.

Customer notification #

If a personal data breach affects customer data under our control, Accept Mission provides customer notification within 2 business days after confirmation of the breach, followed by updates as new information becomes available. Notifications typically include:

What happened (high-level description)
What data may be involved (if known at the time)
What we did immediately (containment and remediation steps)
Recommended customer actions (if applicable)
Next update timing and point of contact

Incident reporting by customers #

Customers can report suspected security issues to [email protected].

Please include:

Workspace or tenant name (if known)
A description of what you observed
Time and date of the event
Any relevant screenshots or logs, if available

3) Resilience principles #

Accept Mission is designed to keep innovation work moving, even when components fail. Our resilience approach is built on:

Redundancy: reduce single points of failure where possible.
Segmentation and isolation: limit blast radius of issues.
Backups: maintain recoverability of critical customer data.
Recovery procedures: documented recovery steps and operational readiness.
Defined recovery targets: measurable objectives for recovery time and recovery point.

4) Backups #

Backup approach #

Accept Mission maintains continuous encrypted backups of customer data to support restoration in the event of accidental deletion, corruption, or infrastructure failure.

Backup protection #

Backups are protected using access controls and encryption. Access to backup systems is restricted to authorized personnel with a clear operational need.

What customers should know #

Backups support disaster recovery and service restoration. They are not a substitute for customer-configured retention and deletion settings inside the platform.

5) Disaster recovery and recovery targets #

Disaster recovery approach #

If a major infrastructure failure occurs, Accept Mission follows recovery procedures designed to restore platform availability and customer data access as quickly as possible. In a region-wide outage scenario, Accept Mission can bring up a duplicate environment in another cloud region, while respecting the agreed data location with the customer.

Recovery targets #

Accept Mission uses the following recovery targets for disaster recovery planning:

Recovery Point Objective (RPO): 24 hours #

This is the maximum acceptable age of data that can be restored from backups.

Recovery Time Objective (RTO): 72 hours #

This is the maximum acceptable time to restore service availability and recover access to data.

These targets are objectives used for planning and operational readiness. Actual recovery times can vary based on incident scope and external dependencies.

6) Hosting region and data location #

Default region #

Accept Mission’s standard hosting region is West Europe.

Enterprise region options #

Enterprise customers can choose to place their database server in another location worldwide, subject to availability and contract terms. Data location and region choices can influence resilience design in region-wide outage scenarios.