Published
Tenant isolation
Every customer organisation has its own tenant-specific environment and separate database, helping keep customer records segregated.
Security, privacy and resilience
Security you can verify.
See how AssetControl Cloud protects the records that keep your organisation moving from people and keys to secure locations, vehicles and equipment.
Production application data is hosted in Germany. Keytracker Ltd, a Cyber Essentials Plus certified organisation, operates the service. Here you’ll find clear answers for security, privacy and procurement reviews.
Core safeguards, built in
These controls are part of AssetControl Cloud today. Use this summary to support your review, your own risk assessment should still reflect how your organisation will use the service.
Published
Access and permissions
Role-based permissions limit what each user can view, change and manage across records and operational workflows.
Published
Multi-factor authentication
Users can add a second layer of protection with an authenticator app or an email verification code.
Published
Traceable activity
Activity and custody histories help authorised users see who performed an action and when it happened.
Published
Microsoft Entra ID SSO
Connect Microsoft Entra ID to give organisations of any size a simpler, centralised sign-in experience.
Where your data lives and who can access it
Start with the essentials below. When your reviewers need more detail, we can provide supporting technical and contractual information.
Hosted in GermanyProduction application data remains within
the EU.
Where is customer data hosted?
AssetControl Cloud production infrastructure is hosted in Germany. Production application data remains within the EU.
Is data encrypted at rest and in transit?
We share current details about transport encryption, storage protection and key management during a security review, so your team can assess the exact controls in scope.
Is MFA supported?
Yes. Each user can configure two-factor authentication with an authenticator app or an email verification code.
Is enterprise SSO available?
Yes. Microsoft Entra ID single sign-on is available to organisations of any size. We agree configuration and rollout requirements during implementation.
How is GDPR addressed?
Our approach includes EU-based production hosting, documented technical and organisational measures, and Article 28 data-processing terms.
Ready when disruption happens
See how we prepare the service for recovery and which commitments are confirmed for your plan and agreement.
Backups and restore testing
We take a server-wide backup every 24 hours and keep backups within the EU. Backup retention details and restore-testing evidence are available during review.
PublishedRecovery objectives
We confirm the recovery point and recovery time objectives that apply to your service during the security and contract review.
Security reviewAvailability and service status
Our public status page shows current service availability and incident updates. We provide the contractual availability commitments for the plan and agreement you are reviewing.
View live service status (opens in a new tab) PublishedClear evidence. Careful claims.
We distinguish Keytracker’s certifications from those held by our infrastructure provider. The evidence we can share may depend on confidentiality, scope and contract stage.
Service operator
Keytracker certifications
Keytracker Ltd, the company behind AssetControl Cloud, holds Cyber Essentials and Cyber Essentials Plus. Its current Cyber Essentials Plus certificate covers the whole organisation except the label-printing network and is due for recertification on 27 November 2026. Keytracker is not ISO 27001 certified.
View certificate (opens in a new tab)
Hosting provider
Infrastructure assurance
Our German hosting provider holds ISO/IEC 27001:2022 certification and a BSI C5 Type 2 attestation for its cloud services. These are the provider’s assurances; they do not make Keytracker or AssetControl Cloud ISO 27001 certified.
We can share the provider’s identity and supporting evidence during your security review.Evidence for your security review
Penetration testing
During your security review, we confirm the scope and recency of testing and which supporting evidence we can share.
Logging and monitoring
We explain our operational monitoring, alerting, log coverage and retention during your security review.
Incident response
We cover escalation, customer communications and the notification terms that apply to your agreement during the review.
Answers for procurement teams
Find out which documents and written confirmations your team can request before approving the service.
As part of your security and privacy review, we provide our current subprocessor list with each provider’s purpose and processing location.
Yes. Contact our team for the current customer data-processing terms and the supporting information your privacy review requires.
Your customer terms set out the available export process, account closure steps, retention period, deletion from live systems and backup expiry.
Send us your questionnaire, or request answers covering hosting, encryption, backups, recovery, identity, testing, monitoring, incident response, subprocessors, data-processing terms, deletion and service availability.
For security and procurement teams
Send us your security questionnaire.
Tell us about your organisation, intended use, data-residency requirements and target timeline. We’ll show you which answers are public, contractual or available under appropriate confidentiality.