Security and Data Protection

GBA Solutions builds custom software and mobile apps for Irish businesses on Google Cloud and Firebase, with client data held in an EU region, encrypted in transit and at rest, and backed up every night to separate off-site storage outside Google. We sign a GDPR data processing agreement when you ask, you own the source code and data, and you deal with one person from start to finish, the person who builds and supports your system.

This page is written for the people who have to check a supplier before a project is signed off, whether that's your IT manager, a procurement officer or whoever fills in the vendor risk assessment. It sets out what we do, and just as importantly, what we don't, so you can make a fair decision.

The short version for your vendor risk assessment

If you only need the headline answers, here they are.

• Systems are built on Google Cloud and Firebase, with data held in an EU region.
• Google Cloud encrypts data in transit and at rest.
• Client data is backed up every night to separate, off-site storage outside Google.
• We sign a data processing agreement (DPA) under GDPR with clients when asked.
• You own the source code and the data for software built for you.
• Secure logins and role-based access mean each person only sees what they need.
• Audit trails and record histories are built in where the system needs them.
• You deal with one person from start to finish, the person who builds and supports the system.
• We don't hold formal security certifications ourselves, but Google Cloud does, and we'll complete your security questionnaire.

Where your data is held

The systems we build run on Google Cloud and Firebase, and client data is held in an EU region. We chose Google Cloud because it gives us the tools we need to build a secure system for each client without you having to run or maintain any servers yourself.

Keeping data in the EU matters for GDPR. It means your personal data stays within the European data protection framework, which takes away a lot of the questions about data leaving the EU that often come up in a risk assessment.

We've written more about this in two blog posts, how Google Cloud Platform helps us help you and keeping your data safe with Google Cloud Platform. You can also read about our Google Cloud Platform services and our work with Google Firebase.

Encryption

Google Cloud encrypts your data in transit and at rest. In plain terms, that means the data is scrambled while it travels between someone's phone or browser and the servers, and it's scrambled again while it sits in storage. Anyone who intercepted it without the key would see nothing they could read.

This is built into the platform, so it doesn't depend on someone remembering to switch it on, and it applies to every system we build there.

Backups and recovery

Client data is backed up every night to separate, off-site storage outside Google. We do this on top of what Google Cloud provides, so there's always a second copy of your data held somewhere independent of the live system.

The point of keeping that copy outside Google is simple. If something went wrong with the live system or the account it runs in, your data would still exist somewhere else and could be restored from there.

Who can see what: logins, roles and audit trails

Secure logins

Every system we build has secure logins, so only people you've given an account to can get in. Google Cloud's built-in authentication supports stronger options such as a code sent to your phone as well as a password, and in our online learning platform for Food Safety Management Solutions learners use a passwordless login.

Role-based access

Not everyone in your organisation needs to see everything, and in most systems they shouldn't. We set up role-based access so each person only sees and changes what they need for their job. A manager, an office administrator, a field worker, a subcontractor and one of your own customers can each have a different view of the same system.

The compliance and certification app we built for AM Site Solutions is a good example. It has separate roles for staff, clients, managers and site leads, with documents tied to machines, users and roles.

Audit trails and record histories

Where a system needs one, we build in an audit trail that records who did what and when. In the AM Site Solutions app, all document activity is logged with a searchable audit trail, there's version control and document history for audit purposes, and the full history of each machine is visible through the system. Their GA1 audit software keeps a full certification history for every machine. For Instaspace Modular, we built reporting for health and safety audits, including safety document acknowledgements and site sign in and out.

GDPR and data processing agreements

When we build and support a system that holds personal data for you, your organisation is usually the data controller and we act as a data processor on your behalf. GDPR expects that relationship to be set out in writing, and we sign a data processing agreement (DPA) with clients when asked. If your organisation has its own DPA template, send it over and we'll work through it with you.

We also think about data protection while we design the system, not after. That means talking through with you what personal data you actually need to collect, who should be able to see it, and which roles need which permissions. Collecting less data and limiting who can see it is one of the most practical things you can do for GDPR.

It's worth being clear that a piece of software can't make an organisation GDPR compliant on its own. How your staff use the system and what your own policies say matter too. What we can do is give you a system that's built to support good practice.

You own your code and your data

You own the source code and the data for software we build for you. You're never locked in to us. Because the system runs in a Google Cloud project, the project, the code and the data can all be handed over if you ever decide to move to another developer or bring the work in house, and you won't lose data in the move.

Procurement teams often ask about this as part of supplier continuity, and it's a fair question to ask any developer, particularly a small one.

Who you're dealing with

GBA Solutions is a technology company based in County Kildare. You deal with one person from start to finish, the person who builds and supports your system. There are no account managers in between, so you always know who to talk to about your system and its data.

For a vendor risk assessment, that keeps the picture simple. There is one person to vet, one point of contact, and one person accountable for how the system is built. You can read more about how a project runs on our our approach page and about us on the about us page.

Certifications, and what we don't claim

As a small developer, we don't hold formal security certifications such as ISO 27001, SOC 2 or Cyber Essentials ourselves. We'd rather say that plainly than leave you to find out halfway through a procurement process.

What we do is build on Google Cloud, which does hold those kinds of certifications for the infrastructure your system runs on. The data centres, the physical security, the encryption and the underlying platform are all run by Google, and Google publishes its own security best practices.

We're happy to complete your organisation's security questionnaire. Send it to us and we'll answer each question plainly, including the ones where the honest answer is that we don't do something. That gives your IT or risk team what it needs to make a proper decision.

Questions to ask any software developer

Whether you hire us or someone else, these are the questions we'd encourage you to ask before you sign.

• Where will our data be held, and in which region?
• Is it encrypted while it travels and while it's stored?
• How often is it backed up, and is the backup held separately from the live system?
• Will you sign a data processing agreement under GDPR?
• Who owns the source code and the data?
• Who exactly will work on our system and have access to our data?
• How will you control what each of our users can see?
• Will there be a record of who changed what?
• What certifications do you hold, and which ones belong to your hosting provider?

Don't just accept the tech jargon. If an answer isn't clear, ask again until it is.

Related services

Everything on this page applies to the systems we build across our main services, including custom software development, mobile app development in Ireland, custom app development, MVP development and business automation. You can see the systems we've built on our portfolio page.

If you have a security questionnaire, a DPA or a vendor risk assessment to get through, get in touch and we'll work through it with you.