Governance

High ethical standards

We hold ourselves to high standards of ethical corporate governance: acting with integrity, being open about how we work, and putting patient safety and the protection of personal information ahead of commercial interest.

Clear accountability

Our Senior Information Risk Owner (SIRO) sits at executive board level, with overall accountability for information security governance. The SIRO is supported by our Compliance and Assurance Team, led by our Service Quality Development Manager, with representatives from our operational, clinical and technical teams.

Policies people follow

Our policies and standard operating procedures are reviewed and approved through executive governance and kept in one place for all staff, who confirm, with a digital record, that they have read and understood each key update. Staff are vetted to the Baseline Personnel Security Standard and complete induction and annual training in information security, cyber awareness and data protection.

Independent Data Protection Officer

Our Data Protection Officer is independent of the company. They advise us on our data protection obligations, monitor how we comply, and act as a point of contact for the organisations we work with, for individuals and for the Information Commissioner's Office, with the freedom to challenge us.

Independent Clinical Safety Officer

Our Clinical Safety Officer is an independent, registered clinician from Safehand Consulting Limited. They oversee our clinical risk management, review our hazard log and approve the clinical safety case for our releases, independently of the teams that build them.

ISO/IEC 27001

Our Information Security Management System is certified to ISO/IEC 27001 and covers every part of our service: risk assessment, access control, incident management, change control and business continuity.

Tested and monitored

We hold Cyber Essentials Plus, and an independent IT Health Check by a CREST-approved provider tests our service at least once a year. Centralised logging and alerting monitor our systems, critical security patches are applied within 48 hours, and administrative access is protected by multi-factor authentication.

Continuous threat detection

We make full use of AWS's security services. Amazon GuardDuty watches our accounts, workloads and data continuously for threats; Amazon Detective helps us investigate any finding quickly; AWS Security Hub brings findings together; and AWS CloudTrail records every action taken in our cloud environment. Findings, audit trails and application logs feed a security information and event management (SIEM) system with alerting, and live and test environments are kept entirely separate.

Strong authentication

Healthcare professionals sign in with NHS Care Identity Service 2 (CIS2), including NHS smartcards. Other users can use passkeys, which resist phishing, and administrative and website editing access requires multi-factor authentication. Access is role-based, so people only reach what their role needs.

Data kept safe and in the UK

Data is encrypted, backed up and stored only in the United Kingdom, across resilient cloud infrastructure. Our information assets are recorded in an asset register with named owners, reviewed by the executive team at least every six months.

NHS Data Security and Protection Toolkit

We complete the NHS Data Security and Protection Toolkit every year and have exceeded its standards in every assessment we have published, from 2018-19 to 2025-26.

Security built into every change

We use Aikido Security across our development pathway to scan our code, the open-source components it uses, infrastructure configuration and containers, and to detect secrets left in code, so vulnerabilities are found and fixed before they reach a live service.

Deployment gating

Releases are gated: a change cannot be deployed until its security scans and automated tests have passed, including the tests that evidence the controls in our clinical safety hazard log. There is no way to skip the gate.

Trusted components

The software components we depend on are pinned to exact, verified versions, with a software bill of materials and regular vulnerability and licence reports, and our services sit behind a web application firewall.

We comply fully with the UK General Data Protection Regulation and the Data Protection Act 2018. For the NHS services we support, we usually act as a data processor, under written data processing agreements that set out exactly what we do with personal data and why.

DCB0129: building safe systems

DCB0129 is the NHS standard for clinical risk management by the makers of health IT. Our clinical risk management system identifies the hazards each change could introduce, the controls for them and the evidence they work, recorded in our hazard log and set out in a clinical safety case report, overseen by our Clinical Safety Officer.

DCB0160: supporting safe use

DCB0160 covers the organisations that deploy and use health IT. We share our clinical safety case and hazard log with the organisations we work with and support their own clinical safety officers as they assess and deploy our services.

ISO 9001

Our quality management system is certified to ISO 9001. Changes go through controlled, ITIL-based change management; incidents and feedback are reviewed so we learn from them; and our processes are audited and improved continually.

Our certifications are renewed through regular external audits; our security is tested independently every year; our business continuity and failover arrangements are tested; and our clinical safety case is reviewed independently for every release.