Compliance- Trust Center
Security, compliance and governance — transparently delivered. Access certifications, policies, and compliance documentation in one centralized portal.
Overview
Trust posture summary
GoLite Mobile operates a governance-first security and compliance programme across all products, infrastructure, and data operations. Our Trust Center provides verified, transparent access to the certifications, policies, and technical controls that underpin our platform.
All documentation is managed through a controlled access model. Public documents are freely available. Restricted materials require identity verification and a signed NDA where applicable.
Certifications
Active certifications and current compliance status of GoLite's key frameworks.
ISO 27001
✓ ActiveInformation Security Management System Validates controls protecting the confidentiality, integrity, and availability of information assets.
SOC 2 Type II
✓ ActiveSecurity, Availability, and Confidentiality trust service criteria independently audited and verified across all platform operations.
GDPR / UK GDPR
✓ CompliantFull compliance with EU and UK GDPR. Includes DPAs, SCCs, and full data subject rights support.
Cyber Essentials Plus
✓ CertifiedUK government-backed scheme validating technical controls against common cyber attack vectors.
ISO 42001 — AI
⟳ In ProgressAI Management System standard alignment.Covering human oversight, explainability, and responsible AI deployment practices.
CCPA Compliance
⟳ In ProgressCalifornia Consumer Privacy Act compliance programme. Technical controls and consumer rights workflows underimplementation.
Zero Trust Architecture — Never Trust, Always Verify
🔐 Security
Architecture, controls, and technical measures
Security
Architecture, controls, and technical measures
Identity & Authentication
MFA · SSO · Zero Trust access
Access Control
RBAC · Least privilege · Privileged access management
Monitoring & Incident Response
24/7 SOC · SIEM · Incident playbooks
Encryption & Data Protection
AES-256 · TLS 1.3 · Key management
Privacy
GDPR CompliantData protection principles and user rights
Lawfulness & Transparency
All personal data is processed lawfully, fairly, and transparently. Customers are informed of data use at point of collection.
Purpose Limitation
Data is collected for specified, explicit purposes and never processed in a manner incompatible with those purposes.
Data Minimisation
We collect only the data that is strictly necessary. No excessive collection. Regular data inventory reviews are conducted.
Storage Limitation
Personal data is not retained longer than necessary. Defined retention periods apply to all data categories.
Your Data Rights
Request Your Data
Subject Access Request (SAR)
Correct Your Data
Right to rectification
Delete Your Data
Right to erasure (Right to be Forgotten)
Data Portability
Receive your data in a structured, machine-readable format
Object to Processing
Right to restrict or object to certain processing
AI Governance
ISO 42001 In ProgressResponsible AI framework — ISO 42001 alignment.
Human-in-Command
All AI-assisted decisions affecting customers or compliance are reviewed and approved by accountable human operators.
Explainability
AI recommendations and automated decisions are logged with explainable rationale, accessible on request.
Policy Enforcement
AI usage is governed by a formal policy framework aligned with ISO 42001 and our internal governance board.
Fairness & Bias
Models are regularly audited for discriminatory outputs. Bias detection is embedded in our model evaluation pipeline.
AI Disclosure
Customers are informed when AI or automated systems are used in decisions that materially affect them.
Data Minimisation
AI models are trained and operated with the minimum data necessary. No unnecessary retention for model training.
⚖️ Risk & Compliance
Active controls and regulatory alignment
Telecom Regulatory Compliance
Ofcom (UK), FCC (USA), TRAI (India) — ongoing regulatory monitoring and reporting
Anti-Bribery & Corruption
UK Bribery Act 2010 and US FCPA compliance. Annual training and third-partyscreening.
Sanctions & Export Controls
OFAC, HMT, and EU sanctions screening. No services provided to sanctioned entities or territories.
PCI DSS (Payments)
Payment Card Industry Data Security Standard compliance for all card processing operations.
Business Continuity & DR
Documented BCP and Disaster Recovery plans. Annual tabletop exercises and quarterly failover testing.
ESG & Sustainability Reporting
Annual sustainability report. Carbon offset programme and Blue Economy commitment tracking.
📜 Policies
Internal governance policies, available for public review.
Information Security Policy
Privacy & Data Protection Policy
Acceptable Use Policy
AI Ethics & Governance Policy
Anti-Bribery & Anti-Corruption Policy
Sanctions & Export Control Policy
Business Continuity & Disaster Recovery Policy
Vulnerability Disclosure Policy
Compliance Documents
Public and restricted access documentation
Privacy Policy
Customer-facing privacy notice
PublicTerms of Service
Customer agreement
PublicCookie Policy
Web and app cookie notice
PublicData Processing Agreement (DPA)
Partner data agreement template
RestrictedSOC 2 Type II Report
Security audit report (qualified partners)
NDA RequiredISO 27001 Certificate
Certification evidence
PublicPenetration Test Summary
Executive summary — latest pentest
NDA RequiredBusiness Continuity Plan Summary
BCP executive summary
RestrictedAI Ethics & Governance Policy
Public policy document
PublicSubprocessor List
Approved third-party processors
PublicCyber Essentials Plus Certificate
UK government certification
PublicAnnual Sustainability Report
ESG & blue economy report
Public