Compliance

1. Security and privacy compliance

ForensicBIM's security programme is designed around the AICPA Trust Services Criteria used in SOC 2 reports, ISO/IEC 27001 and the NIST Cybersecurity Framework 2.0. We have written policies for information security, access control, incident response, disaster recovery, change management, vendor risk, and data retention and disposal.

We do not yet hold an ISO/IEC 27001 certificate or a SOC 2 report, and no independent audit is currently scheduled. On request, and under confidentiality, we share our security policies, a summary of our controls and answers to security questionnaires.

More detail is available in our Trust Centre and in Annex 2 of the Data Processing Agreement.

2. Data protection (GDPR)

• ForensicBIM is based in Amsterdam, the Netherlands, and is subject to the EU General Data Protection Regulation and the Dutch GDPR Implementation Act. Our supervisory authority is the Autoriteit Persoonsgegevens.
• For personal data contained in customer models, we act as a processor under our Data Processing Agreement, which forms part of our Terms of Service. A signed copy is available on request.
• Customers choose the region where their model files are stored and analysed. Transfers outside the European Economic Area are covered by the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
• We notify customers of a personal data breach affecting their data within 48 hours of becoming aware of it.

3. Standards we work with

Our valuations are automated estimates that support, but do not replace, the judgement of the customer's accountants and auditors. See our methodology.

4. Export controls and sanctions

• We comply with the export control and sanctions laws of the European Union, the Netherlands, the United Kingdom and the United States that apply to our business.
• Our Terms of Service do not allow use of the Service from, or for the benefit of a person in, a country or region subject to comprehensive sanctions, or by a sanctioned person or organisation.
• Pro subscriptions are paid through Stripe, which screens payments against sanctions lists.
• We check Enterprise customers against sanctions requirements before entering into an agreement.
• Customers may not upload export-controlled technical data or classified information.

5. Business conduct

• Anti-bribery and corruption. We do not offer, give, ask for or accept bribes, kickbacks or facilitation payments, directly or through others.
• Public officials. We offer gifts or hospitality to public officials only where the rules of their organisation allow it, and never to influence a decision.
• Fair procurement. We follow the procurement rules of the public bodies we work with and do not seek confidential information about competing bids.
• Conflicts of interest. Our staff and advisers disclose any personal or business interest that could conflict with their work for a customer.
• Fair competition. We comply with competition law and do not agree prices or divide markets with competitors.
• Independent results. Scores and valuations are calculated automatically. We do not adjust them to favour any customer.

6. Human rights and suppliers

We do not tolerate forced labour, child labour or human trafficking in our business or among our suppliers, and we would end a supplier relationship over it. Our main suppliers are cloud, payment and software providers. We review them when we start working with them and once a year after that, under our vendor risk policy.

ForensicBIM is not required to publish a statement under the UK Modern Slavery Act 2015 or similar laws. We set out these commitments voluntarily.

7. Information for public sector buyers

For procurement and supplier assessments, we provide:

• our Terms of Service, Privacy Policy and Data Processing Agreement, including a signed copy of the DPA;
• the list of sub-processors and the regions where data is stored;
• security policies, a controls summary and answers to security questionnaires, under confidentiality; and
• contract changes that the law requires for public bodies, such as on governing law or public access to information (section 19 of the Terms).

8. Reporting security issues and concerns

Security vulnerabilities. If you find a vulnerability in the Service, email support@forensicbim.business with the subject "Security report" and enough detail for us to reproduce it. Please do not access other users' data, disrupt the Service or make the issue public before we have fixed it. We will confirm receipt and keep you informed, and we will not take legal action against anyone who reports in good faith and follows these guidelines.

Compliance concerns. Concerns about bribery, sanctions, data protection or human rights can be sent to the same address. We treat reports confidentially and do not tolerate retaliation against anyone who raises a concern in good faith.

9. Contact

Back to top ↑