Quality assurance

We hold externally audited cyber security and organisational control certifications. We manage quality through a documented system that runs across all of our government contracts, supported by independent certification and accreditation. Customers can inspect every part of it. Each control below is measured against the benchmarks in the relevant service agreement and reported each quarter.

Where independent assurance exists, we name the scheme, the certifying body, the legal entity that holds it and the dates it covers. Where it is in progress, we say so.

• Every observation is checked at ingestion. Impossible points and improbable trips are removed.
• Observations are map-matched to the road network by direction, and anything that cannot be matched is discarded.
• Every output shows its sample size, and low-sample results are flagged.
• Methodology, the data dictionary and known limitations are published in the Learning Hub.
• Methodology changes are notified in advance and recorded in monthly release notes.

iRAP, the International Road Assessment Programme, is accrediting Compass's mean and 85th percentile operating speeds under its AiRAP programme. iRAP has already reviewed our sample data. The technical assessment will test our speeds against tube survey data from roads globally. The accreditation will apply to all Compass entities for three years.

Road authorities also test our data against their own measurements. The Road Safety Foundation has compared our speeds on Welsh roads with tube survey data. Transport for Greater Manchester and the Welsh Government have validated our speeds against their own ground-truth data. Each year we also drive connected vehicles from our own dataset through controlled track tests to check speed and g-force outputs. The 2025 results are published and the 2026 test ran in Virginia. Our speed calculation method and validation results are set out in our Speed Calculation and Validation whitepaper, which is available on request.

Each data science deliverable is scoped in writing with the requesting department and tracked to delivery. Every analysis extracts its data from the same platform through our API, so your analysts, your platform users and our data scientists all work from one consistent source of truth. Code is peer reviewed before release, and goes through a multi-stage process, including QA testing, before it goes live to our environment or production software. Every output states its method, assumptions and limitations.

Our Change Management Policy requires every production change to be classified, reviewed by an engineer who did not write it, tested in staging behind automated test gates, and given a rollback plan. Our Vulnerability Management Policy sets remediation targets of 48 hours for critical findings and 7 days for high findings. Both policies are published under Resilience in this Trust Centre.

Compass holds Cyber Essentials, the UK Government's cyber security certification scheme, run by the National Cyber Security Centre. The certificate was issued on 1 September 2026 to Compass IOT Limited, our UK company. Its whole-organisation scope covers the Compass group, including Compass IOT Pty Ltd, and it is valid to 1 September 2027.

Cyber Essentials covers five technical controls: firewalls, secure configuration, user access control, malware protection and security patching. We complete a detailed self-assessment, which an independent certification body reviews. We are now going through Cyber Essentials Plus certification. It covers the whole organisation, including Compass IOT Pty Ltd, and will be completed by 1 December 2026. The difference is how the controls are checked. Cyber Essentials rests on our own answers, reviewed by a certification body. Cyber Essentials Plus adds a hands-on audit: an independent assessor scans our systems for vulnerabilities and tests a sample of our devices and accounts directly, to confirm the controls work in practice.

An independent firm also penetration tests the platform each year, and the executive summary is available on request. The platform runs on Google Cloud infrastructure certified to ISO 27001, SOC 2 and SOC 3 — these are Google's certifications covering the infrastructure layer, not certifications of Compass IoT.

Compass IOT Limited is also an appointed supplier on the UK Government's RM6347 Transport Technology framework, Lot 2, awarded October 2025.

Targets are set in each customer agreement. In our current government contracts, we measure monthly availability against the 99.5% target, acknowledgement of critical outages within one hour during primary service hours, and recovery within our 4-hour RTO and 24-hour RPO.

Every critical outage gets a written report with cause and corrective action. Post-incident reviews feed back into our processes, and corrective actions are tracked through service governance until closed.

The quarterly service report covers each measure above, any data quality or coverage issues, and the corrective actions taken.

The following documents are available depending on your access tier. Email-verified documents require a business email address. On-request documents are available to qualified customers and prospects.