Trust & security

Security built for healthcare data

Care providers handle some of the most sensitive personal data in existence. We treat it that way — with controls equivalent to a modern bank, not a typical SaaS app.

AES-256

Encryption at rest

TLS 1.3 in transit

UK / EU

Data residency

AWS London region

6 yrs

Immutable audit log

Care-sector aligned

24h

Breach notification

30-min critical SLA

Security, visualised

Built to protect vulnerable people’s data

Encryption, UK data residency, least-privilege access and a full audit trail — a quick look at how CareLoop keeps your data safe.

Defence in depth

Twelve controls, working together

Encryption everywhere

TLS 1.3 in transit, AES-256 at rest. Database connections require SSL. Backups encrypted with separate KMS keys.

Tenant isolation by RLS

Every row carries an organization_id. Postgres Row Level Security prevents cross-tenant reads — even our service code can't bypass without explicit override and an audit log entry.

MFA for admins

Mandatory TOTP for org_admin and super_admin roles. Hardware key support (FIDO2) for larger groups.

Daily encrypted backups

Point-in-time recovery to any second within the last 7 days. Daily snapshots retained for 30 days. Quarterly restore-test.

UK / EU hosting

Production runs in AWS eu-west-2 (London) and Vercel London. No US data residency unless contractually required.

Least-privilege access

Engineers access production via short-lived assumed roles, MFA-required, all queries audited. Dual-control for any production write.

Annual penetration testing

External CREST-accredited tester runs an annual pentest. Findings tracked publicly via our /security/changelog.

Full audit log

Every privileged action, every admin login, every data export — logged immutably for 6 years to align with care-sector record-keeping.

Network protection

Cloudflare WAF + DDoS shielding. Rate-limiting by IP and user. Bot management.

Compliance

ICO-registered. UK GDPR. NHS DSPT submission supported. Cyber Essentials Plus certified. ISO 27001 in progress (Q4 2026).

Vendor incident response

24-hour breach notification to controllers. 30-min internal SLA for critical incidents. Quarterly tabletop exercises.

Data minimisation

Only collect what we need to run the service. Health data structured to allow per-field redaction in DSAR exports.

Reporting a vulnerability

We welcome responsible disclosure. Email careloop@ashdub.com with full details. We acknowledge within 24 hours, fix high-severity findings within 7 days, and credit you (with your consent) on our security hall-of-fame at /security/credits.

Our PGP key is available at /.well-known/security.txt.

Security you can hand to your DPO

See the controls on your own data

Bring your IG lead. We'll walk you through RLS isolation, audit logging and data residency live — then import your data so you can see it for real.

Start free trial Book a demo

UK-hosted · ICO-registered · GDPR-compliant