Trust and security
Last updated: 19 October 2026
Data location
Customer data is hosted in the United Kingdom (London) and encrypted in transit and at rest. Each customer's records are isolated by row-level security enforced in the database.
Certifications
| Certification | Status | Issued | Renews |
|---|---|---|---|
| Cyber Essentials | Held | 20 August 2026 | 20 August 2027 |
| Cyber Essentials Plus | Not held | n/a | n/a |
| ISO/IEC 27001 | Not held | n/a | n/a |
| NHS Data Security and Protection Toolkit | Not held | n/a | n/a |
- Cyber Essentials Plus: A separate, independently audited certification from Cyber Essentials.
- ISO/IEC 27001: SoftCare's security policies are being written to this standard. Certification is not claimed.
SoftCare Technologies Ltd is registered with the Information Commissioner's Office under number ZC204698.
Security controls
- Multi-factor authentication is required on every SoftCare administrative account, on every service that offers it. (Policy.)
- Every code change is scanned for exposed credentials before it is merged. (Technical control.)
- Every code change is checked by static security analysis before it is merged. (Technical control.)
- Python dependencies are checked for known vulnerabilities on every code change before it is merged. (Technical control.)
- Each customer's data is isolated at database level by row-level security, and code changes are tested to confirm that isolation before they are merged. (Technical control.)
- The production database is backed up continuously with point-in-time recovery, and restores are tested. (Policy and technical control.) Last restore test: 24 September 2026.
- Data is encrypted in transit and at rest. (Technical control.)
- Uploaded files are held in separate, durable object storage, not on application servers. (Technical control.)
- In-product AI Features are disabled for each organisation until that organisation enables them. (Technical control.)
- Customer data is not used to train, fine-tune or evaluate any AI model, by SoftCare or by any sub-processor. (Policy.)
Evidence for each control is available to customers on request.
Personal data breaches
We notify affected customers within 48 hours of becoming aware of a personal data breach affecting their data, as set out in clause 8 of our Data Processing Agreement.
Documents
Contact
Security questionnaires and data protection requests: [email protected].