Skip to content

Public sector

Evidence for the framework you report against

Cyber Essentials Plus, NIS2 and national guidance, with residency and accessibility that survive a procurement review — and content that works for a workforce spanning field staff, contact centres and clinicians.

UK / EU
residency per tenant
WCAG 2.2 AA
accessible content
24
languages
HOW THIS WORKFORCE IS REACHEDEmail62%SMS51%Voice24%TRADECRAFT AIMED AT THEMBenefit and permit notices, supplier invoices, field-staff smishing29%6%Median across public-sector deployments

Assurance

Documentation before the questionnaire arrives

Residency, subprocessors, DPA, SOC 2 and ISO certificates, accessibility statement and disclosure policy are all published rather than requested, which removes the usual three-week loop from a procurement timetable.

  • UK (London) or EU (Ireland) residency per tenant
  • Published subprocessor register with change notice
  • Accessibility statement and WCAG 2.2 AA content
Request — Authenticated session, org resolved from the subdomainRequestAuthenticated session, org resolved from the subdomainTenant context — orgId bound to the async execution context — not a request argumentTenant contextorgId bound to the async execution context — not a request argumentRepository layer — Every query is scoped before it reaches the driverRepository layerEvery query is scoped before it reaches the driverPostgres row-level security — The database refuses cross-tenant reads even if the app is wrongPostgres row-level securityThe database refuses cross-tenant reads even if the app is wrongYour data — Encrypted at rest, keys in a managed vaultYour dataEncrypted at rest, keys in a managed vault
Two independent enforcement layers. A bug in one does not become a data breach.

Coverage

A workforce that is not uniform

Field staff on mobiles, contact centres on shared workstations, and office functions on laptops — each reached on the channel that works, and each graded on the same scale so a single number means something across the whole body.

  • SMS reach for field and frontline staff
  • Shared-workstation delivery
  • Multi-language, captioned modules
0%10%20%30%40%Baseline: 33.2% phish-prone33.2%Baseline90 days: 20.1% phish-prone20.1%90 days12 months: 4.2% phish-prone4.2%12 months−87%
Phish-prone rate over 12 months of continuous simulation and training. Source: KnowBe4 2026 Phishing by Industry benchmark (33.2% → 20.1% → 4.2%).

Questions

Asked on every first call

The ones that decide whether a first call turns into a second one.

1 questions

Where is our data held?

In the region you select at provisioning — UK (London) or EU (Ireland) for public-sector customers — including backups. Processing does not cross the boundary, and the subprocessor register lists the region for each processor.

Request the procurement pack

Residency, DPA, certifications, accessibility statement and disclosure policy in one bundle.

See your human risk in 20 minutes

Book a demo and we’ll run a sample campaign against a test group.