Clients' IT, security and procurement teams will ask. Send them the links below, and forward any security questionnaire to [email protected]. We answer it for you.
Where is the data hosted?
In the EU. MuchSkills is GDPR-native. The sub-processor list and data location are on the Trust Center.
Is there a data processing agreement?
Yes. The DPA is published and forms part of the Enterprise Terms, so no separate signature is needed. A signed copy is available on request. The client is the controller and MuchSkills the processor.
Is MuchSkills certified?
MuchSkills is not ISO 27001 certified and has no SOC 2 report. Its information security management system is aligned to ISO/IEC 27001, with certification in progress. An independent web application penetration test was carried out in August 2026 with no critical, high, medium or low findings; the letter of attestation is on the Trust Center.
What availability do you commit to?
A 99.5% operational target, measured monthly, described in the Service Description and Service Levels on the Trust Center. Contractual commitments are agreed in an individual contract.
Backups and recovery?
Backups run at least every six hours and are kept for up to 90 days. The recovery point objective is no more than 24 hours and the recovery time objective 72 hours.
Can we get our data out?
Yes. The client owns its data and can export all of it at any time, self-service or through the API, at no charge, in a structured, machine-readable format, and for around 90 days after a contract ends.