Trust and security
Trust and security.
We sell assurance. It would be poor form not to hold ourselves to it. This page sets out how Velinor is certified, how we handle your data, and how to report a vulnerability to us.
Last updated
Registrations
- Company number
- 15700539Check at Companies House
- ICO registration
- ZB845813Registered 6 January 2025.Expires 5 January 2027.Check at the ICO register
- Cyber Essentials (Basic)
- ebf06a14-1a10-4d91-beb7-63617dfdf902Issued to ITMATTERS AI LTD, our former name.
- RM6200
- Appointed supplier on the Artificial Intelligence Dynamic Purchasing System.Appointed 2 September 2026.Agreement page
- D-U-N-S
- 231763472
Certifications
Certifications and registrations
- Cyber Essentials (Basic), certificate ebf06a14-1a10-4d91-beb7-63617dfdf902. It was issued to ITMATTERS AI LTD, our former company name, under the same company number.
- Registered with the Information Commissioner’s Office, registration ZB845813, valid to 5 January 2027.
- Appointed supplier on the Government Commercial Agency (formerly Crown Commercial Service) Artificial Intelligence Dynamic Purchasing System, RM6200.
- Registered in England and Wales, company number 15700539. D-U-N-S 231763472.
Velinor is not currently certified to ISO/IEC 27001 as an organisation.
This website
How this website is secured
- TLS enforced, with HTTP Strict Transport Security.
- Content Security Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy set.
- No third-party scripts, analytics or advertising trackers on this site, and no cookies of our own.
- Our booking calendar opens on our provider’s own page, so nothing third-party runs on velinor.io.
Email authentication
The velinor.io domain publishes SPF with a hard fail, DKIM, and DMARC at p=reject with strict alignment and 100% enforcement. Mail claiming to be from Velinor that does not authenticate will be rejected, not quarantined.
If you receive an email purporting to come from Velinor that you believe is fraudulent, please forward it to contracting@velinor.io.
Client data
Handling client data
- Client data is held in Google Workspace under a data processing agreement, with data at rest in the EU/UK.
- Access is on a least-privilege basis and reviewed as staff and sub-consultants join or leave engagements.
- A copy of our data processing agreement, and our sub-processor list, is available on request.
- Engagement material classified above OFFICIAL is handled only on client-provided systems, never on Velinor infrastructure.
Disclosure
Vulnerability disclosure
If you believe you have found a security vulnerability in a Velinor system, we want to hear from you. Email contracting@velinor.io with the word “security” in the subject line, or see our machine-readable policy at /.well-known/security.txt.
Please give us a reasonable opportunity to remediate before any public disclosure. We aim to acknowledge a report within 2 working days and to give you an assessment within 10 working days.
We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and do not exfiltrate data. We do not currently operate a paid bug bounty.