Trust centre
How we keep 250+ WordPress sites secure, fast and online.
This page states the infrastructure, security controls, backup strategy and operational practices behind every site we manage, in the same terms we use when a client’s procurement team asks. We are an Automattic for Agencies Pro Partner.
How we protect your site
WP Cloud infrastructure
- Pressable, an Automattic company, on the WP Cloud platform
- Primary data centre in Amsterdam, in the EU
- SOC 2 Type 2 and ISO/IEC 27001:2013 certified facility
- All Pressable data centres Uptime Institute Tier III or IV
Hardening and firewall
- Web application firewall on every site we host, with a hardening layer on Premium and Custom
- HostLogic Shield, our own security header plugin, being rolled out to managed sites in sequence
- Role-based access control applied to every site
- Audited Activity Log on Premium and Custom
Scanning and malware protection
- Continuous vulnerability scanning with patch-level reporting
- Malware scanning runs daily across the managed estate
Backups and recovery
- Daily off-site backups on every plan, retained 30 days
- Real-time incremental backups with one-click restore on Premium and Custom
- Backups stored independently of the hosting platform
Updates, reviewed and staged
- Updates reviewed and tested on a staging copy before deployment on Premium and Custom
- Security patches prioritised
Incident response
- Defined severity levels, critical incidents answered within 1 business hour
- Recovery target of 4 business hours for site availability
- Defined in our Business Continuity and Disaster Recovery Plan, tested at least annually
Operational practices
Weekly site audits
- Every managed site reviewed weekly: uptime, performance, security posture, updates and backups
Documented procedures
- Every routine task runs from a written runbook, so the service does not depend on any individual
Change logging
- The Activity Log on Premium and Custom records every user action, plugin update and content change
Staged updates
- Plugin and theme updates tested before they touch a production site on Premium and Custom
Proactive monitoring
- Uptime, response time and error monitoring run continuously on every site
Accountable people
- Three named contacts carry the continuity chain, so the service does not depend on one individual
Data protection and due diligence
EU data residency
- Pressable WP Cloud infrastructure operates in EU regions for sites on our standard deployment, which is the Amsterdam data centre
- We process site and visitor data only as needed to deliver the service
- Where in-country Irish residency is required, dedicated Irish hosting is available and quoted on application
GDPR
- A GDPR Article 28 Data Processing Agreement is available
- We commit to breach notification without undue delay, so a client’s 72-hour regulatory window can be met
Confidentiality
- Access to your site, credentials and infrastructure is limited to named team members and logged
- NDAs are available for sensitive engagements
Vendor due diligence
- BCP/DRP and its test results, ESG policy statement, DPA and named sub-processor list provided on request
- Security and outsourcing questionnaires completed in full, in writing
- Included with every care plan, and so are the reviews that follow. Exceptionally large or repeated exercises are scoped with you first
We implement and evidence the technical and organisational measures behind these obligations. Responsibility for regulatory compliance, governance and acceptance of the evidence remains with the client.
Certification by datacentre
| Datacentre | Certifications |
|---|---|
| Amsterdam our standard EU deployment | SOC 2 · ISO/IEC 27001 |
| Los Angeles | SOC 1 Type 2 · SOC 2 Type 2 · ISO/IEC 27001 |
| Dallas-Fort Worth | SOC 1 Type 2 · SOC 2 with CSA STAR Type 2 · SOC 3 |
| Ashburn | SOC 1 Type 2 · SOC 2 Type 2 · ISO/IEC 27001 |
Source: Pressable, datacenter certifications and regulatory compliance.
Sub-processors
| Provider | What it does | Where |
|---|---|---|
| Pressable (Automattic) | Hosting and WP Cloud infrastructure | Amsterdam, EU on our standard deployment |
| Jetpack (Automattic) | Security scanning, activity log and backups | Platform service |
| Gravity Forms | Form submissions, stored in the site database | Self-hosted on the site |
| Calendly | Call scheduling, where a call is booked | Third-party embed |
| YouTube (Google) | Video embeds, where used | Third-party embed |
The complete named sub-processor list, with roles and locations, is provided in writing on request and forms part of the Data Processing Agreement.
How the evidence is produced
A reviewer’s first question is how we know. The answer is a fixed cadence that runs the same way for every site under care, and a record of each run.
The audit
Every site is checked against one list: core and plugin versions, backups completed and restore-tested, uptime and response time, SSL, security scan, Core Web Vitals, and accessibility regressions on key pages. Each finding is triaged critical, warning or advisory, and criticals are actioned the day they are found.
The report
A written report per site: what was done, what changed, and every finding opened or closed with its date. It is filed to your client portal, so the file builds itself.
The packs
The security evidence pack on Premium and Custom, the manual accessibility re-test where Monitoring Plus is taken, and the due-diligence pack refreshed so the sub-processor list and the SLA version are current.
What the evidence looks like
Frequently asked questions
Can we see your SOC 2 report?
The certifications above belong to the platform we run on, Pressable on WP Cloud, and we provide those certificates and the datacentre detail on request. HostLogic itself is not SOC 2 certified, and we say so plainly rather than implying otherwise. Our own controls are documented, evidenced and open to your review.
Do you sign a Data Processing Agreement?
Yes. A GDPR Article 28 Data Processing Agreement is available, including the named sub-processor list. We commit to breach notification without undue delay so your 72-hour regulatory window can be met.
Where is our data hosted?
On our standard deployment, the Amsterdam data centre, in the EU. Where in-country Irish residency is required, dedicated Irish hosting is available and quoted on application.
Will you complete our security questionnaire?
Yes, in full and in writing. Initial due diligence when you engage us is included with every care plan, as are the reviews that follow. Exceptionally large or repeated exercises are scoped with you first.
Do you have a business continuity plan?
Yes. Our Business Continuity and Disaster Recovery Plan is provided on request along with its test results. It is tested at least annually, and it defines the 4 business hour recovery target for site availability.
Who has access to our site?
Access to your site, credentials and infrastructure is limited to named team members and is logged. Three named contacts carry the continuity chain. NDAs are available for sensitive engagements.
Send us your questionnaire.
We answer procurement and outsourcing questionnaires in full, in writing, and the documents above are yours on request.