Our systems & partnerships
 

Professional accreditation is an important part of how we maintain and demonstrate our Drupal expertise. Zoocha invests in Acquia certification pathways across Drupal development, site building, front-end and back-end specialisms, helping our teams keep their knowledge current as the platform evolves.

Our certifications span Drupal 7 through to Drupal 11, reflecting both our deep experience supporting long-standing Drupal estates and our capability to design, build and evolve modern platforms. Our team includes Acquia Certified Developers, Site Builders, Front End Specialists, Back End Specialists and Triple Certified Drupal experts.

Zoocha has more Acquia Triple Certified Drupal experts than any other UK-based agency, giving clients access to exceptional depth of independently verified Drupal expertise. You can view our current credentials on the public Acquia Certification Registry.

Accessibility is built into how we design, develop, and support digital services. As an IAAP-certified organisation, with individually certified team members, we bring specialist knowledge to creating inclusive Drupal platforms that work for everyone.

Our user experience designers, visual designers and front-end developers collaborate throughout delivery to embed accessibility from the outset. We work to achieve, as a minimum, WCAG 2.2 AA compliance, using a combination of best practice, ongoing manual and automated testing, and independent specialist audits where appropriate.

We have delivered externally verified accessible platforms for organisations including the Financial Conduct Authority, Ofsted, the Greater London Authority, Guy’s & St Thomas’ NHS Foundation Trust and Westminster City Council. We help clients make accessibility a sustained commitment, not a final-stage check, through accessible design, robust development and continuous improvement.

Cyber Essentials PLUS is a UK Government scheme that aims to help you protect your organisation against a range of cyber attacks. This self-assessment accreditation was a useful exercise to go through ahead of our ISO27001:2013 journey.

Zoocha have been Cyber Essentials Certified since January 2016, and achieved the improved Cyber Essentials PLUS standard in October 2018, which we have been continuously revalidating.

Understanding how and why a page works, on every device, is at the very core of producing a successful design. At Zoocha we have in depth knowledge and experience in making designs that will work for you and your customers.

The Nielson Norman Group who are internationally recognised as thought leaders in the field of UX, with their widely published and often quoted principals of Jakob Nielsen, Don Norman and Bruce Tognazzini setting their standards and leading them.

The NN/g's training and UX Certification that we achieved gave us in-depth, targeted learning about the most important UX areas, effective UX techniques and about how to deliver consistent high quality UX output.

The Government Baseline Personnel Security Standard (BPSS) is the minimum level of personnel security screening required for individuals working with, or on behalf of, UK Government departments and other organisations operating within security-sensitive environments. BPSS provides assurance regarding an individual's identity, integrity, trustworthiness and right to work in the UK.

At Zoocha, personnel security is an important component of our wider Information Security Management System (ISO 27001), Privacy Information Management System (ISO 27701) and Business Management System. As a result, our screening process goes beyond the baseline BPSS requirements and incorporates additional verification activities aligned with recognised industry best practice, including the principles of BS 7858:2019 Screening of Individuals Working in a Secure Environment.

As part of our onboarding and personnel screening process, Zoocha conducts a range of checks, which may include:

• Identity verification using documentary and electronic verification methods.
• Right to work checks to confirm eligibility to work in the relevant jurisdiction.
• Employment and activity history verification covering previous employment, education and other relevant periods of activity.
• Basic criminal record checks where legally permissible and appropriate to the role.
• Address history verification.
• Sanctions and watchlist screening, including checks against relevant UK and international sanctions registers.
• Politically Exposed Person (PEP) screening where appropriate.
• Adverse media screening to identify material integrity, fraud or reputational concerns.
• Overseas residence declarations and supporting verification where individuals have spent significant periods outside their country of employment.
• Ongoing personnel security obligations through policies, training, confidentiality agreements and security awareness activities.

These checks help mitigate risks associated with identity fraud, unauthorised access to systems and information, financial crime, insider threats and regulatory compliance requirements.

By combining BPSS requirements with additional screening measures and controls aligned to BS 7858 principles, Zoocha provides clients with assurance that individuals entrusted with their systems, infrastructure and information have undergone a robust and consistent level of verification.

Agile delivery is central to how we manage complex digital projects. Our team holds Scrum Alliance certifications across both ScrumMaster and Product Owner disciplines, bringing recognised expertise in collaborative planning, prioritisation and continuous improvement.

Scrum provides a practical framework for delivering complex websites and digital platforms in manageable, iterative stages. It helps teams stay focused on user needs and business priorities, while giving clients clear visibility, regular feedback opportunities, and the flexibility to respond to change.

By combining experienced delivery leadership with proven Agile practices, we help teams reduce risk, maintain momentum and deliver lasting value throughout the project lifecycle.

"The Data Protection Act 1998 requires every organisation that processes personal information to register with the Information Commissioner’s Office (ICO), unless they are exempt."

Zoocha have been registered with the Information Commissioners Office as a Data Controller since January 2016.

ITIL is a globally recognised framework for managing and continually improving IT services. At Zoocha, ITIL principles underpin how we deliver support: providing a shared language and structured approach for working with clients and stakeholders across complex digital services.

Our Service Desk operates in alignment with ITIL v4 best practice, with defined processes for incidents, problems, changes and service levels. These practices help us deliver consistent, transparent and measurable support, with clear accountability and a focus on continual improvement. 
Service-Desk-Support.md

ITIL-aligned ways of working form part of Zoocha’s audited Service Management System, helping ensure our support services are reliable, scalable and responsive to each client’s needs. 

Zoocha is committed to fair pay and responsible employment. We pay all UK employees at least the London Living Wage, reflecting our belief that everyone should earn a wage that supports a decent standard of living. 

This commitment forms part of our wider approach to creating a fair, inclusive and supportive workplace. By investing in our people through fair pay, professional development and opportunities to grow, we build a stronger, more sustainable team for our clients and communities.

Zoocha is a signatory to the Fair Payment Code and holds Gold Award status. This reflects our commitment to building transparent, equitable and sustainable relationships with the suppliers and partners that support our work. 

We recognise the importance of reliable cash flow, particularly for small and medium-sized businesses. We are committed to paying 95% of supplier invoices within 30 days, helping provide the certainty and fairness our supply chain needs to thrive. 

Our Gold status also reflects a wider commitment to responsible procurement: treating suppliers fairly, avoiding practices that create unnecessary pressure, and encouraging lead suppliers to adopt the Fair Payment Code throughout their own supply chains.

Zoocha is a Disability Confident Employer, reflecting our commitment to creating an inclusive workplace where disabled people and people with long-term health conditions can thrive.

We are committed to attracting, recruiting, developing and retaining talented people with disabilities. This includes considering and implementing reasonable adjustments during recruitment, such as adapting interviews, assessments or tests, so that candidates can demonstrate their skills on an equitable basis.

We believe inclusive employment practices strengthen our team, our culture and the services we deliver. Our aim is to create an environment where everyone has the opportunity, support and confidence to do their best work.

Zoocha is certified as a Carbon Neutral organisation through Carbon Neutral Britain, having achieved certification in November 2024.

This certification reflects our commitment to measuring and managing the carbon emissions associated with our operations, reducing our environmental impact wherever possible and addressing residual emissions in accordance with the Carbon Neutral Protocol.

Carbon neutrality forms part of our wider environmental strategy and complements our ISO 14001-certified Environmental Management System. Together, these frameworks help us set environmental objectives, monitor performance and continually improve how sustainability is embedded across our business, from day-to-day operations and business travel to procurement and supplier decisions.

For our clients, partners and stakeholders, this provides independently verified assurance that Zoocha takes a structured and accountable approach to its environmental responsibilities.

AWS has been Zoocha’s preferred cloud hosting partner since 2010. Today, we use AWS to host and support the vast majority of our client websites and digital platforms, including mission-critical services where security, resilience, availability and performance are essential.

Our Zoocha Hosting Platform is built on AWS, combining reusable Infrastructure as Code, AWS-native operational tooling, automated infrastructure change, monitoring and security controls. This gives clients a robust, scalable foundation that can be tailored to their requirements for traffic, integrations, data sensitivity, recovery objectives and ongoing support.

Our team includes AWS Certified Solutions Architects and continues to deepen its expertise through hands-on delivery, knowledge-sharing and close engagement with AWS. We help clients make well-informed cloud decisions and gain lasting value from their AWS investment.

We use leading third-party AI systems, including frontier models from Anthropic, OpenAI, Google, and other providers, and always select the most appropriate technology for each use case. Whether supporting research, content workflows, software delivery, automation or AI-enabled digital experiences, we focus on applying AI where it can deliver meaningful, measurable value.

Our ISO 42001-certified Artificial Intelligence Management System governs our approach. This ensures AI tools and services are selected, configured and used with appropriate consideration for security, privacy, transparency, risk and human oversight. Zoocha does not develop or train proprietary foundation models; instead, we responsibly integrate and manage third-party AI capabilities within the digital services we deliver. 

By combining practical technical expertise with robust AI governance, we help clients explore and adopt AI with confidence, balancing innovation with accountability.

Cloudflare is Zoocha’s primary recommendation for content delivery network (CDN) and edge-security services. It helps Drupal platforms perform faster and more reliably for users worldwide, using distributed edge caching to reduce latency and protect origin infrastructure from traffic spikes.

Its integrated Web Application Firewall (WAF), bot-management capabilities and advanced DDoS mitigation provide an important additional layer of protection against malicious traffic and common web-application attacks. We configure and manage Cloudflare as part of a wider, defence-in-depth approach to platform security.

Cloudflare is used by approximately 75% of Zoocha clients that implement a CDN. We tailor the configuration to each platform’s performance, security and operational requirements, helping clients deliver secure, resilient and high-performing digital services.

Zoocha has worked with Acquia since 2012, supporting organisations including the Financial Conduct Authority and the Payment Systems Regulator. As an Acquia Community Partner, we bring practical experience in building, maintaining and evolving Drupal platforms hosted on Acquia.

We also have extensive experience helping clients migrate onto Acquia, including complex Drupal platform migrations. Our approach begins with a thorough assessment of the existing platform, integrations, data, environments, security and operational requirements, followed by a clear migration plan that manages risk and minimises disruption. 

Our teams have experience managing Acquia environments, from platform configuration and day-to-day operations to deployment workflows and ongoing support. We can also work with the Acquia Cloud API to introduce greater automation and control within delivery pipelines, including integration with automated testing.

Acquia can be a strong fit for organisations that already use the platform, need to align with an established technology estate, or want to make use of its wider digital experience capabilities, such as personalisation and digital asset management. We help clients make the most of the Acquia services they choose, while keeping their Drupal platform secure, reliable and ready to evolve. 

Zoocha is a Top Tier ranked service provider of the Drupal Association, reflecting our longstanding commitment to Drupal and the community that supports it.

The Drupal Association is the non-profit organisation that supports Drupal and its global community by providing essential funding, infrastructure, education, and promotion, and by maintaining Drupal.org as the central platform for collaboration and contribution.

Our support goes well beyond membership. Zoocha is a Signature Supporting Partner of the Drupal Association, and we provide additional financial support to important parts of the Drupal ecosystem. This includes sponsoring the Gin and Claro administration themes, the Webform module, Drupal contributors, the Drupal AI Initiative, and other community-led initiatives. We also regularly sponsor Drupal events including DrupalCon Europe, DrupalCon USA, DrupalCamp England, DrupalCamp Spain and Drupal Developer Days.

Community participation is equally important to us. Zoocha team members have attended every European DrupalCon since 2011, regularly participate in DrupalCamps and other community events, and contribute time and expertise back to Drupal. We have also opened our offices to the community for Drupal code sprints and collaborative contribution events.

For us, supporting Drupal means more than building websites with it. We actively invest in the people, projects, events and infrastructure that help the open source ecosystem continue to grow and thrive.

Atlassian tools are central to how we plan, deliver, and support digital services. We use Jira Software to manage project delivery, giving teams and clients clear visibility of priorities, progress and delivery activity.

Confluence provides a shared, accessible knowledge base for project documentation, technical information, decisions and assets, creating a single source of truth throughout the engagement. For ongoing support, Jira Service Desk helps us manage requests, incidents and service communications through structured, consistent workflows.

Together, these tools support transparent collaboration, strong knowledge retention and efficient delivery from discovery through to long-term support.

GitHub sits at the centre of Zoocha’s secure software delivery process. It provides robust version control across our development environments, enabling teams to collaborate effectively, maintain a clear history of change and manage releases with confidence. 

Every change is subject to established pull-request, peer-review, testing and approval processes before it is merged or deployed. This helps ensure that code meets agreed standards, supports maintainability and is reviewed for quality and security throughout delivery. Automated CI/CD pipelines and testing further help identify regressions and issues early. 

Access to repositories is managed through named accounts, mandatory multi-factor authentication and least-privilege controls. Repository configuration is governed to ensure it supports Zoocha’s development standards and does not bypass secure development lifecycle controls. 

Reliable digital services depend on early visibility of potential issues. Zoocha continuously monitors core infrastructure, networks, applications and security events to help identify service degradation, availability issues, unusual behaviour and potential security incidents before they have a wider impact. 

Our monitoring covers areas including infrastructure health, resource utilisation, application performance, authentication and access activity, deployments, backups and configuration failures. Core infrastructure is monitored 24/7, with alerts routed to the appropriate team members for prompt triage and investigation. 

Monitoring is built into the design of new environments and integrates directly with our incident-management processes. When an alert is triggered, it can automatically create a Jira Service Desk incident, enabling our teams to assess severity, investigate, communicate and respond in line with agreed service levels. 

This proactive, structured approach supports secure, resilient and dependable operation for the business-critical digital platforms we manage.

Quality and security are built into Zoocha’s delivery process from the outset. Our CI/CD pipelines and automated assurance tooling help identify issues early, maintain consistent standards and reduce the risk of defects or vulnerabilities reaching production.

Depending on the project, automated checks can include code-quality and standards validation, static analysis, dependency and vulnerability scanning, browser and performance testing, and accessibility checks. We use tools including SonarQube, CodeSniffer, Trivy, OWASP ZAP, testssl.sh, Pa11y, RoboShadow and Nessus to assess code, dependencies, infrastructure, configuration, application security and user experience. 

These checks run regularly and during deployments, with findings logged, prioritised and addressed through our established delivery and support processes. Combined with peer review, manual QA and specialist security testing where appropriate, this provides a robust, layered approach to delivering secure, reliable and maintainable digital platforms.

Security is embedded throughout Zoocha’s Secure Development Lifecycle (SDLC), from discovery and solution design through to development, testing, deployment and ongoing support. We apply a secure-by-design, defence-in-depth approach that is proportionate to each platform’s risk profile, technical complexity and the sensitivity of the data it processes.

Our SDLC brings together secure coding practices, peer review, automated quality and security checks, vulnerability management, testing and operational monitoring. This helps our teams prevent, identify and remediate issues early, while ensuring every change is delivered through controlled, repeatable processes. 

Where AI-enabled tools support development workflows, such as code generation, analysis or automated refactoring, they operate within a human-in-the-loop model. AI-generated outputs are reviewed and validated by our developers before they are relied upon, and workflow owners remain accountable for their behaviour and outcomes. The use of AI is governed by our ISO 42001-aligned Artificial Intelligence Management System, with appropriate controls for security, privacy, quality and client requirements.

Guided by recognised application-security principles, including the OWASP Top 10, our Secure Development Lifecycle helps us deliver digital platforms that are secure, reliable, maintainable and ready to evolve.

Zoocha uses Infrastructure as Code to define, manage and evolve the cloud infrastructure behind our hosting services. Our Zoocha Hosting Platform is built on a standardised, modular AWS architecture implemented primarily through Terraform. 

Rather than configuring infrastructure manually, we use reusable, version-controlled code to provision and manage environments consistently. This improves repeatability, visibility and control, while allowing each platform to be tailored to its requirements for performance, security, resilience, integrations and support.

Our reusable Terraform platform code, AWSCore, is versioned through GitHub Releases and deployed through controlled GitHub Actions workflows. Client environments reference known versions of this shared foundation, enabling us to improve platform capabilities over time while maintaining clear control over change. 

Infrastructure changes are assessed and introduced through Zoocha’s established development and change-management processes, helping ensure our platforms remain secure, reliable and ready to evolve.

The Zoocha Hosting Platform is our standard AWS-based architecture for hosting and operating secure, resilient and high-performing Drupal platforms. It combines reusable Infrastructure as Code, AWS-native operational tooling, automated infrastructure changes, and monitoring and security controls with our extensive experience designing and supporting Drupal services on AWS. 

Built on a standardised, modular Terraform architecture, the platform provides a consistent foundation while remaining adaptable to each client’s requirements. Infrastructure and operational controls can be tailored around service criticality, traffic and performance needs, data sensitivity, availability and recovery objectives, integrations, regulatory obligations and support requirements.

The platform includes Drupal-aware configuration, caching, CDN capability, elastic compute and managed databases, plus edge protection, identity and access management, network segmentation, encryption, and centrally controlled administration. Continuous monitoring, logs, metrics and alerts provide the visibility needed to identify and investigate potential issues quickly.

The Zoocha Hosting Platform is actively maintained and continually improved through our controlled development and change-management processes, ensuring it remains secure, reliable and ready to evolve with client needs.

Last updated: 12 October 2026

Zoocha uses selected third-party service providers and Zoocha Group companies to support the delivery of its development, hosting, maintenance and support services.

Where Zoocha processes personal data on behalf of a client, these organisations may act as sub-processors. The sub-processors applicable to a particular client depend on the services purchased, the systems used for that engagement and any client-specific contractual arrangements.

Zoocha remains responsible for its sub-processors in accordance with its contractual obligations and applicable data protection law.

Cloud infrastructure and service delivery

Development, project management and support

Monitoring, logging and service assurance

Testing services

Zoocha Group companies

The following Zoocha Group companies may process personal data where their personnel participate in delivering development, maintenance, technical support or related services for a client:

Access by Zoocha Group personnel is restricted according to role, business need and the requirements applicable to the client engagement.

Processing locations and international transfers

Zoocha seeks to use United Kingdom or European Union hosting locations where appropriate and available. Some providers operate globally or provide support from additional countries.

Where processing involves an international transfer of personal data, Zoocha applies the transfer mechanism and safeguards required by applicable data protection law and the relevant client agreement. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, or other approved contractual protections.

The location shown in this list is a summary. A provider's exact processing locations may depend on the selected service, hosting region, support request and configuration.

Changes to this list

Zoocha may update this list when a sub-processor is added, replaced or no longer used.

Where required by a client agreement or applicable data protection law, Zoocha will provide notice before appointing a new sub-processor that will process personal data covered by that agreement. Clients may raise a reasonable data-protection objection in accordance with the terms of their agreement with Zoocha.

Questions about this list or Zoocha's use of sub-processors can be submitted through the client's usual Zoocha contact or service-management channel.