Security and your data

MyStand2 is the system we use to manage your training: bookings, trainers, course sign-in, registers and certificates. Here is how we keep it, and your information, safe.

Where your data is kept

MyStand2 runs on Cloudflare, a global infrastructure provider whose platform is certified to ISO 27001 and audited to SOC 2.
Our database currently runs in Cloudflare's London data centre.
All stored data is encrypted at rest (AES-256), and everything sent between your browser and MyStand2 is encrypted in transit (HTTPS/TLS).
The database has continuous point-in-time backups, so it can be restored if anything goes wrong.

Who can see it

Everyone who uses MyStand2 has their own login. Staff and trainers sign in with a one-time code sent to their mobile.
Access is limited by role. Trainers only see details of the courses they are delivering, and never see pricing or other trainers' information.
Where client access is provided, it is limited to your own organisation’s records.
Stand2 administrators can remove access instantly and sign a person out of every device.

Course sign-in and registers

Each course has its own sign-in code, which only works while the trainer has sign-in open on the day.
For organisations that need it (for example NHS trusts), we can require verified sign-in, so only the genuine person can sign the declaration – either by a one-time code sent to their work email address, or by an identity check in person by the trainer.
Every register entry keeps an audit trail: when the person signed in, how they were verified and by whom, and the exact wording of the declaration they agreed to.

How MyStand2 is protected

Limits on login and code attempts to stop password-guessing and abuse.
Protection against common web attacks, including cross-site request forgery and malicious scripts, with modern browser security headers on every page.
Uploaded and emailed files are handled so they cannot run code inside MyStand2.
An internal security review against the OWASP Top 10 was completed in November 2026, and will be repeated as the system develops.
Stand2 is certified under the UK Government-backed Cyber Essentials scheme.

Your personal data

We collect only what we need to run training: delegate names, work contact details, attendance and results, so we can keep the training register, issue certificates and remind you when refreshers are due.
We handle personal data in line with UK GDPR. We do not sell or share it for marketing.
We keep data only for as long as it is needed. Retention periods are available on request. Our full privacy notice is on stand2.com.
You can ask to see, correct or delete personal data we hold by contacting us.

Questions or a security concern?
Email info@stand2.com and we'll respond promptly. We're happy to complete supplier security questionnaires.

Stand2 (Specialist Training & Development) Ltd · Company No. 05466304 · Privacy notice · Last updated November 2026