Security & Compliance
How we protect care data: UK hosting, encryption, audit trails and UK GDPR controls. Our controls are aligned with all 10 NHS Data Security and Protection Toolkit (DSPT) standards.
Security Measures
Encryption at Rest & In Transit
The main database sits on an AES-256 encrypted disk (LUKS2) on our UK server, and stored files and backups are encrypted with AES-256 in AWS London. Data in transit is protected by TLS 1.2/1.3 with HSTS enforced.
Strong Authentication & Password Policy
Enforced across every entry point — signup, login, and password reset all require 10+ characters with mixed case, numbers, and symbols. Account lockout after 5 failed attempts. 8-hour session timeout.
Mandatory Multi-Factor Authentication
TOTP-based two-factor authentication is mandatory for all Owner and Admin accounts. Privileged users are guided through setup on first login and cannot disable MFA once enabled. Server access uses SSH keys only (no passwords) and is limited to two named people.
Care Record Audit Logging
Every create, update, and delete action on care records — including daily notes, care plans, risk assessments, and incidents — is logged with user ID, timestamp, and record reference to ensure accountability.
Automated Monitoring & Scanning
Automated rate limiting, bot blocking and intrusion banning run around the clock, with email alerts to our team when attack spikes occur. Our software is scanned for known vulnerabilities every week, and backups are restore-tested every month.
Tamper-Proof Audit Logs
Audit log records are preserved even if user accounts are deleted. User references are set to null rather than cascading deletions, ensuring a complete, unbroken audit trail for regulatory inspections.
DSCR-Compliant Data Export
Full-content data export covering care plans, daily notes, risk assessments, and incidents is provided in machine-readable JSON format to support data portability and Subject Access Requests (SAR).
Data Isolation & Access Control
Strict logical data isolation per customer is enforced. Access is governed by Role-Based Access Control (RBAC) with granular permissions, following the principles of least-privilege and “need-to-know.”
Incident Response & Breach Notification
MyCareAudit maintains an incident management process. We commit to notifying affected customers without undue delay and within 48 hours of confirming a personal data breach.
AI Data Privacy
How we protect your data during AI-assisted processing
1Data Minimisation Before Inference
We send only the information each AI feature needs, and all AI processing runs on Azure OpenAI in the UK. No care data is sent to AI services outside the United Kingdom.
2Zero Data Retention
Data sent for AI processing is used solely for real-time inference and is not retained by the AI provider after the response is generated, in accordance with provider policies and our Data Processing Agreement.
3No Model Training
Your care data is never used to train, fine-tune, or improve AI models. This is guaranteed under our provider’s Privacy Policy and enforced through contractual restrictions in the DPA.
AI inference is provided by Azure OpenAI (UK South), which processes requests within the United Kingdom under zero-retention agreements. No care data is used for model training or improvement.
UK Data Residency & Sub-processors
🇬🇧 Customer Data Hosted in the UKCustomer data is hosted on UK-based infrastructure. Care records, AI processing and file storage remain within the United Kingdom. Email delivery uses Brevo in the EU; payments use Stripe; website analytics and ads use Google, only with visitor consent.
Application Server
IONOS VPS — London, United Kingdom
ISO 27001 certified data centres
AI Processing
Azure OpenAI — UK South (London)
Zero data retention, no model training
File Storage
AWS S3 — eu-west-2 (London)
AES-256 encryption at rest
Sub-processors
- IONOS SE — Application hosting, compute (London, UK). ISO 27001 certified.
- Microsoft Azure — AI inference via Azure OpenAI (UK South). SOC 2 Type II, ISO 27001 certified.
- Amazon Web Services (AWS) — File storage via S3 (eu-west-2, London). SOC 2 Type II, ISO 27001 certified.
- Stripe — Payment processing. PCI DSS Level 1 certified.
- Brevo (Sendinblue SAS) — Email delivery (EU). ISO 27001 certified.
- Google — Website analytics and ads on our public site, only with visitor consent. No care records.
Care records, AI processing and file storage stay in the UK. Email delivery via Brevo takes place in the EU, which is covered by UK adequacy regulations.
NHS Data Security & Protection Toolkit
MyCareAudit’s security controls are designed to align with the 10 data security standards defined by the NHS DSPT. All 10 standards are currently aligned. Formal “Standards Met” status follows submission of the official NHS DSPT assessment, and we will update this page when that is confirmed.
Personal Confidential Data
Care data is held on UK infrastructure with the database on an AES-256 encrypted disk. Processing follows documented instructions and lawful bases under Art. 6 and Art. 9.
Staff Responsibilities
Role-based access inside the app. Access to hosting, source code and file storage is limited to two named people: the owner and the developer.
Training
Our sole system administrator completed NHS Data Security Awareness Level 1 training on 2 October 2026, recorded in our training log. New starters complete it before getting access, and it is renewed every year.
Managing Data Access
Written access control policy with joiner and leaver steps. Two-factor login is on for every supplier account that can reach our systems or data, available to every app user and enforced for Owner and Admin roles. There is a single administrator account, and server access is SSH-key only.
Process Reviews
An automated quarterly review pack covering access, MFA, backups, restore tests, vulnerability scans, patching and certificates is produced every quarter and signed off by the owner. The first review ran in October 2026.
Responding to Incidents
Written incident response plan with named roles, severity levels, ICO reporting within 72 hours and customer notification within 48 hours, backed by automated attack alerts, tested backups and rollback. The plan is practised every year.
Continuity Planning
Encrypted daily backups stored in AWS London, with an automated restore test every month.
Unsupported Systems
Weekly automated vulnerability scanning, automatic operating-system security updates and a patch policy with fix deadlines. The database and PDF components have no open critical or high issues. One web component is past vendor support: it is listed, risk-assessed and formally accepted by our Senior Information Risk Owner, protected at the server, and scheduled for upgrade by 31 March 2027.
IT Protection
Server firewall, SSH-key-only login, rate limiting, bot blocking and automatic banning of abusive IPs.
Accountable Suppliers
Supplier register and due-diligence procedure in place. Sub-processors handling customer data: IONOS, Microsoft Azure (UK South) and AWS (London), Brevo (EU, email delivery) and Stripe (payments). Data processing terms are being confirmed and filed for each supplier as part of our DSPT work. Google Analytics and Google Ads run only on our public website and only with visitor consent; they never receive care records.
GDPR Compliance
We operate a UK GDPR-aligned privacy and security programme, designed to support compliance with the UK General Data Protection Regulation and the Data Protection Act 2018.
| Article | Requirement | How We Comply |
|---|---|---|
| Art. 5 | Principles | Lawfulness, fairness, transparency, purpose limitation, data minimisation (only necessary data collected), accuracy, storage limitation, integrity & confidentiality. |
| Art. 6 | Lawful Basis | Contract for providing the service and subscriptions, legitimate interests for security and business-contact emails, consent for analytics and advertising cookies. |
| Art. 9 | Special Categories | Special category data processed under Art. 9(2)(h) — management of health or social care systems and services — and Art. 9(2)(c) — vital interests — where applicable. Supported by Schedule 1, Part 1, Condition 2 of the Data Protection Act 2018. |
| Art. 25 | Data Protection by Design | Privacy built into architecture: encryption at rest, logical data isolation per customer, UK-hosted infrastructure, access controls, data minimisation at the AI inference layer, and comprehensive audit logging. |
| Art. 28 | Processor Obligations | Data Processing Agreements with each sub-processor (being confirmed as part of our DSPT work). Processing only on documented instructions. Confidentiality obligations for all personnel. |
| Art. 32 | Security of Processing | AES-256 encryption at rest, TLS in transit, logical data isolation, automated attack alerts, weekly vulnerability scanning and monthly backup restore tests. |
| Art. 33 | Breach Notification | Processor notifies without undue delay per DPA terms. MyCareAudit commits to notifying customers within 48 hours of confirming a breach, and reports qualifying breaches to the ICO within 72 hours. |
| Art. 44–49 | International Transfers | Customer data is hosted and processed in the United Kingdom. AI inference uses Azure OpenAI (UK South) with zero data retention. File storage uses AWS S3 (eu-west-2, London). Email is delivered by Brevo within the EU, which is covered by UK adequacy regulations. Stripe (payments) and Google (website analytics and ads, with consent) may process limited account or visitor data outside the UK under UK transfer safeguards. |
Data Processing Principles
- Data collected only for specified, explicit purposes
- Minimum data collected for each function
- Data kept accurate and up to date
- Retained only as long as necessary
- Processed with appropriate security measures
- Transparent processing with clear privacy notices
Your Data Rights
- Access: Export all your data in JSON or CSV format at any time
- Rectification: Update your personal information via Settings
- Erasure: Request account and data deletion
- Portability: Download data in machine-readable format
- Restriction: Request restriction of processing
- Objection: Object to processing for direct marketing
Infrastructure & Hosting
Full transparency about where your data is stored and the security standards that protect it. Customer data is hosted in the UK.
IONOS VPS (London)
- RegionUnited Kingdom (London)
- ProviderIONOS SE
- CertificationsISO 27001, ISO 50001
- Physical SecurityBiometrics, CCTV, 24/7 patrols
- EncryptionAES-256 encrypted database disk, TLS 1.2/1.3
Azure OpenAI (UK South)
- RegionUK South (London)
- ProviderMicrosoft Azure
- CertificationsSOC 2 Type II, ISO 27001
- Data RetentionZero — no data stored
- Model TrainingProhibited by contract
AWS S3 (eu-west-2)
- Regioneu-west-2 (London)
- ProviderAmazon Web Services
- CertificationsSOC 2 Type II, ISO 27001
- EncryptionAES-256 (SSE-S3)
- Access ControlBucket policies + IAM
🇬🇧 UK Data Residency: Customer data is hosted in the United Kingdom. Application hosting is on IONOS VPS in London, AI processing uses Azure OpenAI in UK South, and file storage uses AWS S3 in eu-west-2 (London). Care records, AI processing and files stay in the UK (email delivery uses Brevo in the EU). Your data is encrypted at rest, logically isolated per customer, and never sold. It is shared only with the named suppliers above, under contract.
Providers using MyCareAudit
Questions About Security?
Our Data Protection Officer is available to answer any security or compliance questions.