Security approach
Services are designed around controlled access, supported technology, secure configuration, monitoring, recovery and documented ownership. The exact controls in scope are confirmed in the service agreement.
Trust centre
Clear answers about security, data and reporting.
This centre explains ISG’s public commitments and reporting routes. Detailed control evidence, contractual responsibilities and supplier information can be reviewed during due diligence where appropriate.
Security is an operating responsibilityNot a badge or a one-off exercise
Data handling
Customer and website information is handled for defined purposes with access limited to people and suppliers who need it. Controller, processor, retention and transfer responsibilities are documented where relevant.
Incident reporting
Customers should report suspected security incidents through the managed-services route and call for urgent or service-impacting events. Reports are triaged so containment and communication can begin quickly.
Responsible disclosure
Researchers can report a suspected vulnerability privately. We ask for enough detail to reproduce the issue, reasonable time to investigate and no access to data beyond what is necessary to demonstrate the finding.
Report securely
Security incident or vulnerability?
Do not include passwords, private keys or unnecessary personal information in an initial email.
Disclosure guidelines
Help us investigate responsibly.
- Describe the affected service, steps to reproduce and potential impact.
- Do not disrupt services, use social engineering or attempt physical access.
- Do not download, alter, retain or share customer or personal information.
- Give ISG a reasonable opportunity to investigate and remediate before public disclosure.
- This public route does not create a bug-bounty programme or authorise unlawful activity.
Policies and availability
More trust information.
Review website privacy and accessibility information or open the live service-status portal.