Everything your review team needs
Buyer-friendly security and privacy information, with sensitive implementation details and controlled evidence kept out of the public domain.
Security
Platform, application, identity, encryption and vulnerability controls in place.
Privacy
Customer data handling, residency, retention, consent and deletion.
Compliance
Verified certifications, legal documents and assurance evidence.
Resilience
Regional distribution, service redundancy, continuity and recovery.
AI trust
Transparent statements about providers, processing, retention and training.
Responsible experimentation
Privacy, accessibility, fairness and responsible customer experiences.
The essentials, in one place.
A concise overview of the security, privacy, infrastructure and assurance controls relevant to customer security reviews.
Need evidence for your security review?
Key security, privacy, compliance and assurance documents are available below for self-service access.
Verified evidence, stated precisely
ISO 27001:2022
Webtrends Optimize maintains ISO 27001:2022 certification covering the information security management system supporting the delivery of its services.
See Security ResourcesPCI DSS
Webtrends Optimize is designed to avoid the collection, storage or processing of payment card information. Customers should not provide payment card data within the platform.
Payment card data excludedUK GDPR and GDPR
Webtrends Optimize operates in accordance with UK GDPR and EU GDPR requirements and provides customers with a Data Processing Agreement and supporting privacy documentation.
Legal documentation available on requestCyber Essentials
Cyber Essentials certification information can be provided where applicable as part of the security review process.
Current status available on requestPenetration testing
Independent penetration testing and security assessments are performed to evaluate security controls and identify areas for continuous improvement.
See Security ResourcesB Corp Certified
Webtrends Optimize is a certified B Corporation, demonstrating high standards of social and environmental performance, transparency and accountability.
Independent certificationSecurity is actively monitored, governed and continuously improved
Security controls are supported by governance, risk management, workforce responsibilities and ongoing review.
Information security governance
Security is governed through a formal information security management system supported by documented policies, defined ownership and regular management review. Security responsibilities are assigned across leadership, engineering and operational teams to ensure controls remain effective and aligned with business risk.
Risk management
Information security and privacy risks are assessed through an ongoing risk management process. Risks are reviewed, prioritised and tracked according to their potential impact, with mitigation activities monitored through established governance processes.
Security awareness
All personnel receive security awareness training and are expected to comply with company security policies. Training is supplemented by periodic awareness campaigns and role-specific guidance where relevant.
Access reviews
Access to systems and customer data is granted according to least-privilege principles. User access rights are reviewed periodically and are updated promptly when personnel join, change roles or leave the organisation.
Supplier assurance
Third-party suppliers are assessed before engagement and reviewed throughout the relationship. Security, privacy and data-processing considerations form part of supplier selection and ongoing assurance activities.
Policy management
Information security policies are maintained, reviewed and approved on a regular basis to ensure they remain aligned with legal, regulatory and operational requirements.
Continuous Security Monitoring
Production infrastructure is continuously monitored for suspicious activity, unauthorised access attempts and security events. Security telemetry is analysed to support rapid detection, investigation and response.
Vulnerability Management
Systems are regularly assessed for known vulnerabilities and configuration risks. Identified issues are prioritised according to risk and addressed through defined remediation and change-management processes.
Audit Logging
Security-relevant and administrative events are logged to support monitoring, incident investigation and compliance activities. Audit trails provide accountability and help support forensic analysis when required.
Endpoint Visibility
Managed infrastructure is monitored to provide visibility into system health, configuration changes and security events. This helps identify potential threats early and supports effective operational oversight.
Defence in depth
Public statements distinguish architecture-supported information from controls requiring owner validation.
Edge protection
Internet-facing requests pass through regional application gateways providing WAF inspection and layer 7 traffic distribution.
Architecture-supportedIdentity and access
A dedicated Access Control Service validates tokens and enforces role-based access for platform APIs.
Architecture-supportedTenant isolation
Customer environments are logically separated through application-level authorisation controls, identity enforcement and data-access boundaries designed to prevent unauthorised cross-customer access.
Control details available on requestEncryption
Data transmitted between users and Webtrends Optimize services is protected using industry-standard encryption protocols. Encryption controls are also applied to supported storage services and backup processes to protect data confidentiality.
See Security ResourcesSecure development
Webtrends Optimize follows secure-development practices that include peer review, testing, dependency management and controlled release processes. Security considerations are incorporated throughout the software development lifecycle.
Engineering controls available on requestMonitoring
Security and operational events are monitored to support the detection, investigation and remediation of potential issues. Logging and alerting controls help maintain service reliability and support incident-response activities.
Operational controls available on requestGlobal edge services
Cloudflare Edge Workers support geolocation lookups, Social Proofing, Recommendations and selected AI-service proxy workloads.
Edge architectureAccess controls buyers can evaluate quickly
State which controls apply to customer users, privileged administrators and workforce identities. Remove unsupported capabilities before publishing.
Customer authentication
Webtrends Optimize provides authenticated access to customer-facing services using secure account management controls designed to protect customer environments and administrative functions.
Enterprise SSO
Enterprise identity federation options are available for organisations seeking centralised authentication and identity management through supported identity providers.
Multi-factor authentication
Multi-factor authentication can be used to provide an additional layer of protection beyond passwords, reducing the risk of unauthorised account access.
Role-based access
Role-based permissions enable customers to assign appropriate levels of access based on business responsibilities, supporting least-privilege administration practices.
User lifecycle
User accounts can be created, updated and removed through established administrative processes, allowing organisations to maintain control of access throughout the employee lifecycle.
Audit history
Security-relevant administrative and platform activities are logged to support investigation, monitoring and governance requirements.
A clear customer data lifecycle
For an experimentation platform, consent, tracking and role clarity should be as visible as infrastructure security.
Where customer information is processed
Customer data processing locations, backup locations and retention periods are summarised below to support security, privacy and procurement reviews.
| Data category | Purpose | Primary location | Backup location | Retention |
|---|---|---|---|---|
| Experiment and account data | Platform operation | Azure EU Region | Secondary Azure EU | 12 months |
| Visitor event data | Collection, analytics and reporting | Azure EU Region | Secondary Azure EU | 12 months |
| Security and application logs | Monitoring, support and investigation | Azure EU Region and Secondary Azure EU | Secondary EU Region | 6 months |
| Support data | Customer assistance | Atlassian Cloud EU | N/A | Length of contract |
| Backups | Recovery and continuity | Secondary EU Region | N/A | 3 months |
Transparent, Sovereign and Responsible AI
Webtrends Optimize incorporates AI-powered capabilities while maintaining strict controls around privacy, governance, security and customer data ownership.
Where AI Is Used
AI capabilities include product recommendation engines, automated reporting insights, automated survey insights, predictive heatmaps, synthetic user testing, coding copilots, MCP servers, in-product guidance and help-centre assistants.
AI Governance
Webtrends Optimize operates centralised AI governance, allowing suppliers and technologies to be reviewed, approved and managed centrally in accordance with GDPR and the EU AI Act.
Sovereign AI
Where practical, AI workloads are executed on Webtrends Optimize managed infrastructure rather than external LLM services, creating stronger data boundaries and data privacy protections.
No Customer Data Training
Customer content is not used to train Webtrends Optimize AI models. Proprietary and open-source models are pre-trained before use.
External AI Providers
Where external AI services are used, contractual terms prevent Customer Content being used to train third-party large language models.
Customer Isolation
Customer information is never shared with other customers, including indirectly through model training or shared AI workloads.
Data Ownership
Customers retain ownership of both Customer-provided content and AI-generated outputs created within the Webtrends Optimize platform.
Security by Design
AI features operate within the same security and privacy framework applied across the platform, incorporating ISO 27001, Cyber Essentials and regular penetration testing practices.
Accuracy & Monitoring
AI-generated outputs are monitored and reviewed. Controls exist around current AI services such as Product Recommendations and Predictive Heatmaps, with feedback mechanisms planned for future AI capabilities.
Customer AI Commitments
| Area | Commitment |
|---|---|
| Customer Data Training | No customer content is used to train WTO models. |
| Third-Party Training | Contracts prohibit Customer Content being used to train external LLMs. |
| Customer Isolation | Data cannot be shared with other WTO customers. |
| Data Ownership | Customers retain ownership of content and generated output. |
| Privacy | AI operates within WTO privacy and security controls. |
| Transparency | Where possible, AI outputs should include meaningful reasoning and explanations. |
| Opt-Out | Customers currently opt into AI features, with account-level opt-out controls planned. |
Webtrends Optimize does not expect customers to provide Personal Data for AI processing. Customers are expected to use AI-enabled features in accordance with their contractual obligations and platform terms.
Availability supported by distributed design
Regional distribution
Geo-aware ingress routes collection and test-delivery traffic to regional service pools.
Architecture-supportedLoad distribution
Application gateways and internal load balancers distribute workloads across services.
Architecture-supportedData redundancy
The analytics tier is represented as a multi-node, zone-distributed ClickHouse cluster.
Architecture-supportedRTO and RPO
Business continuity and disaster recovery processes are designed to support the restoration of critical services following a significant disruption. Recovery objectives are reviewed as part of ongoing resilience planning and testing activities.
Recovery targets available on requestBackups and restoration
Backup processes are used to support service recovery and data resilience. Backup integrity and restoration procedures are periodically tested to help ensure recovery objectives can be achieved.
Operational controls available on requestOperational resilience
Critical platform and security-management systems are protected through backup and recovery procedures designed to support business continuity and timely restoration of services where required.
Recovery processes available on requestService status
Real-time information regarding service availability, planned maintenance and operational incidents is available through the Webtrends Optimize status page.
View status pageSecure, ethical and human-centred optimisation
A differentiated trust position for organisations that want experimentation to improve experiences without undermining privacy, accessibility or customer autonomy.
Privacy by design
Experiments should use proportionate data, respect consent choices and avoid unnecessary collection.
Accessibility
Test experiences should preserve accessibility and avoid creating barriers for users.
No deceptive patterns
Experiments should not manipulate people into choices they would not otherwise make.
Fairness
Teams should consider whether targeting, personalisation or outcomes could unfairly disadvantage users.
Human accountability
Customers remain accountable for experiment design, approval, monitoring and intervention.
B Corp Certified
Webtrends Optimize is a certified B Corporation, demonstrating a commitment to high standards of social and environmental performance, accountability and transparency.
Third-party transparency
Accelerate Group Ltd. ("Webtrends Optimize") engages sub-processors who may access Customer Data, including Personal Data relating to end-users of customers' websites and applications, while providing the Services.
What is included in this register?
This register lists providers with potential access to visitor or customer data. It does not include third parties acting as independent controllers for Webtrends Optimize's own business operations, such as billing, CRM and internal communications.
Visitor Data
Visitor Data means Personal Data relating to end-users of customers' websites or applications, as further described in Annex 1 of the Webtrends Optimize Data Processing Addendum.
Current sub-processors
| Sub-processor | Parent entity | Purpose | Since | Location of processing |
|---|---|---|---|---|
| Microsoft Azure | Microsoft Corporation | Primary cloud hosting platform for compute, data storage, databases and platform services underpinning the Webtrends Optimize experimentation platform. | 2018 | Europe, USA and Australia |
| Cloudflare | Cloudflare, Inc. | Primary Edge Worker service enabling edge compute for Social Proofing, Recommendations, geolocation lookups and, for some applications, proxying AI services such as handling LLM prompts. | 2019 | Global edge network |
| Atlassian | Atlassian, Inc. | Customer support ticketing platform. Support tickets may contain customer-submitted Personal Data limited to information customers voluntarily include in support requests. | 2018 | Europe |
How we manage sub-processors
Advance notice of changes
For customers who have executed the Webtrends Optimize standard DPA, we provide at least 15 days' prior written notice before engaging a new sub-processor. During this period, customers may object on reasonable and legitimate data-protection grounds.
If no objection is raised within the notice period, the new sub-processor is deemed accepted. Where a valid objection cannot be accommodated without materially altering the Services, the customer may elect to terminate the affected portion of the Services without penalty, in accordance with the DPA.
To receive advance notifications, ensure that your DPA is executed and your registered contact email remains current.
Prepared response and clear communication
Webtrends Optimize follows a structured incident-management process designed to support rapid containment, investigation, remediation and customer communication where required.
1. Detect and triage
Monitoring, reporting channels, validation and severity assignment.
2. Contain and investigate
Limit impact, preserve evidence and determine affected systems and data.
3. Remediate
Remove the cause, restore services and validate corrective action.
4. Notify
Communicate in accordance with approved contractual and legal obligations.
5. Recover
Return services to normal operation and monitor for recurrence.
6. Learn
Perform a post-incident review and track improvements.
Downloadable resources
Any documents that are shared by Webtrends Optimize. Non-public documents will need an account in Webtrends Optimize
AI in Webtrends Optimize
Summary of how Webtrneds Optimize adopt AI in the product
PublicDownload PDFReport a security vulnerability
We welcome responsible and good-faith disclosure of security vulnerabilities affecting Webtrends Optimize services. Reports are reviewed by the security team and acknowledged as quickly as practical. Verified vulnerabilities are prioritised according to risk and tracked through remediation to resolution.
What to include
Affected asset, reproduction steps, potential impact, supporting evidence and a safe contact method. Do not include personal or customer data.
Publication controls
Add approved acknowledgement targets, disclosure timing, safe-harbour wording, PGP details and any bug-bounty terms before presenting them as commitments.
Legal and security approvalReach the right team
Replace or consolidate the addresses below according to your approved operating model.
Security and assurance
Security resources, questionnaires and assurance evidence.
security@webtrends-optimize.comPrivacy and data protection
Questions about sub-processors, data protection or objection rights.
privacy@webtrendsoptimize.comOperational incidents
Customers requiring assistance during a service-impacting incident should contact the Webtrends Optimize support team using their normal support channel or designated customer escalation route. Significant incidents are communicated through established customer-notification processes.
Incident escalation routeStraight answers for review teams
How is internet-facing traffic protected?
The supplied architecture describes regional application gateways providing WAF inspection and layer 7 load balancing before traffic reaches application services.
How does the platform authorise API access?
A dedicated Access Control Service is described as validating tokens and enforcing role-based access for platform APIs.
Is the platform multi-region?
The architecture describes geo-aware routing and regional service pools across Azure regions. Customer-specific residency and contractual availability commitments must be confirmed separately.
Does Webtrends Optimize support SSO or MFA?
Webtrends Optimize supports enterprise identity integration and authentication controls designed to help organisations manage user access securely. Multi-factor authentication can be enforced through supported identity providers, allowing customers to align platform access with their existing security policies.
Where is customer data stored?
Customer data is primarily processed within approved Microsoft Azure regions. Additional processing locations, backups and sub-processors are detailed within the data residency and sub-processor sections of this Trust Centre.
How can we obtain assurance evidence?
Security, privacy and assurance resources are available in the Security Resources section of this Trust Centre. Additional controlled evidence may be provided where appropriate.
Does Webtrends Optimize train AI models on customer data?
In short, we do not do this.
Our models are all pre-trained, either using our own proprietary research or open-source models that we host. For these, there is no use of your data to train our models.
This also applies to our current use of external API providers. Our agreement with them is such that “Customer Content” cannot be used to train their LLMs, and they simply host and serve content on our behalf.
How does Webtrends Optimize detect security incidents?
Security and operational events are continuously monitored to support the detection, investigation and response to potential security incidents. Monitoring, alerting and review processes form part of our wider security and resilience programme.
Recent changes
Everything your review team needs in one place
Access security, privacy, AI governance, business continuity, subprocessor and assurance resources from a single location.