Yes - we have updated our Privacy policy, our Terms and Conditions and have a general GDPR statement that outlines how SightMill has worked to GDPR compliance.
SightMill is classed as a Processor, so your company will be classed as a data Controller and you will need to list SightMill as a recognised Processor.
SightMill takes security very seriously and we partner with Rackspace (a leading server provider) to ensure our servers and architecture have been designed and managed with security first. Rackspace and our servers are managed to ISO/IEC 27001 ...