> This is the Markdown of a Backed Help Centre page, https://admin.backed.giving/help/administrator/getting-started/security-and-privacy-review.md. Every page is listed at https://admin.backed.giving/help/llms.txt.

> This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.

If your organisation reviews a new system before it goes live, such as an IT security review, a
privacy impact assessment or procurement checks, Backed supports it as part of onboarding. Tell your
onboarding contact who your reviewer is and what they need, ideally in your first planning call, so
the review is finished before go-live.

## What your onboarding contact sends

- **The security pack**: the documents a security reviewer asks for.
- **The data-sovereignty statement**: who can see your data and how access is controlled, where your
  data is processed, and what you can take out of Backed.

Each request and each delivery is recorded on `Settings > Onboarding`, under
`Security and privacy review`, with the date it was requested and the date it was delivered. See
[Onboarding sessions](onboarding-sessions.md).

## The Legal Centre

Backed's legal documents are published in its Legal Centre, at backed.giving/legal, each version at
its own address:

- the `Terms of Use`, the `Privacy Policy` and the `Data Processing Agreement`. A document still
  being prepared says so;
- `Cookies`: every cookie a Backed site sets, and why;
- the `Privacy compliance statement`: how Backed meets each Australian and New Zealand privacy
  principle, and the evidence for each;
- `Subprocessors`: the service providers that process data for Backed, and their countries. Your
  organisation's owners are emailed at least 30 days before a subprocessor is added or changed,
  and an Administrator can object under `Settings > Privacy`.

## Settings your reviewer will ask about

- **Where your data lives.** On `Settings > Profile and terms`, the `Hosting and data protection`
  panel shows your hosting region and, for each service, its provider and region. Regions not yet
  confirmed in a provider's console say `Assumed, to be confirmed`. See
  [Organisation settings](../organisation/organisation-settings.md).
- **Two-factor authentication.** On `Settings > Security`, require it for everyone or for chosen
  roles, with a grace period. See [Security settings](../organisation/security-settings.md).
- **Single sign-on.** On `Settings > Profile and terms`, the `SSO` tab connects your identity
  provider over SAML 2.0 or OpenID Connect, and `SSO-only mode` makes it the only way in. See
  [Single sign-on](../../integrations/single-sign-on.md).
- **Who can do what.** Each Administrator holds named permissions, set on `People > Administrators`;
  each person sees their own on the `My access` tab of `Your account`. See
  [Administrators and permissions](../users/administrators-and-permissions.md).
- **The audit log.** `Settings > Audit log` lists every recorded change, by whom and when. Entries
  cannot be changed or deleted. See [Audit log](../audit/audit-log.md).
- **Log streaming.** `Settings > Security` shows whether logs and audit entries are streamed to your
  security team's collector.
- **Privacy requests.** `Settings > Privacy` records each request from a person about their
  information, with its due date, the identity check and the decision, and exports or erases the
  person's information. See [Privacy requests](../organisation/privacy-requests.md).
- **Reporting a breach.** `Report a suspected data breach` on `Settings > Security` sends a report
  to Backed's security team. If a breach affecting your organisation is confirmed, your owners and
  the Administrators who manage organisation settings are emailed within 24 hours of it being
  verified.

## See also

- [The public trust page](public-trust-page.md)
- [Requesting the security pack](security-pack-request.md)
- [Security settings](../organisation/security-settings.md)
- [Onboarding sessions](onboarding-sessions.md)
- [Getting help](getting-help.md)