Trust centre
What we do with your data, where it lives, who can reach it, and how to tell us if something is wrong. Written for the person who has to sign off on us.
Last reviewed 13 October 2026. We will complete your own security questionnaire on request.
Certifications and standing
| Cyber Essentials | In progressCertification targeted December 2026. |
|---|---|
| Cyber Essentials Plus | PlannedOnce Cyber Essentials is held. Targeted June 2027. |
| ISO/IEC 27001 | In progressNot currently certified. Implementation in progress, certification targeted December 2027. Our controls are documented in the sections below and we will evidence them against your questionnaire in the meantime. |
| ICO registration | RegisteredRegistered as a data controller and processor, reference ZC251036. |
| Professional indemnity insurance | Being arrangedIn place by November 2026; certificate available to buyers on request from that date. |
| Cyber liability insurance | Being arrangedIn place by November 2026; certificate available to buyers on request from that date. |
Product status
One table, kept in step with every product page and with the home page. If a product page and this table ever disagree, this table is wrong and we would like to know.
| Product | Status | Deployed for | What we can show you now |
|---|---|---|---|
| Secura SSO | Live in production | Our own platforms, serving live users daily since September 2026. No third-party UK customer yet. | Architecture walkthrough, a proof of concept against a non-production tenant, a completed security questionnaire. |
| Cairnova Casework | In development Prototype available | No customer. No contract. | A live demonstration of the staged prototype, end to end, with the engineer who built it. |
| Secura CMS | In development | No customer. No contract. | A walkthrough of the built modules and the regulatory provenance register; the DPIA register. |
| Secura Excursions | In development Built and staged | No customer. No contract. | A live demonstration of the staged system, proposal to closure; our go-live audit and DPIA on request. |
Secura SMS, our school management platform, is in production serving schools in Nigeria. It is not marketed in the United Kingdom and is listed here only because it is the live workload beneath Secura SSO. All of its data is held in AWS London.
Data
- Where it is held
-
All production data is held in the United Kingdom, in AWS London (eu-west-2). That covers the application, the database, object storage, backups and telemetry. Personal data is stored nowhere else.
Two narrow exceptions concern delivery, not storage, and both are listed under subprocessors below with their safeguards. Where a council turns on phone alerts in Secura Excursions, Apple’s and Google’s push services carry a message encrypted end to end to the phone; they see neither its content nor anyone’s name. And text messages are sent through GOV.UK Notify, which is UK-hosted, unless a customer chooses a different provider in writing.
This applies to every deployment we operate, including those serving customers outside the UK. We do not maintain data in any other region.
- Separation between customers
-
Each organisation's data is isolated by row-level security enforced in the database itself, applied to every role including the application's own login. Cache entries are namespaced per tenant. Separation therefore does not depend on application code being free of defects.
- Encryption
-
In transit: TLS throughout, including between internal services, which authenticate to each other with mutual TLS using short-lived certificates.
At rest: full-disk and managed-service encryption, with personal and special category fields additionally encrypted individually using AES-256-GCM.
- Retention and deletion
-
Retention periods are set per record type against the statutory minimums for the sector, and are configurable where the law allows a range. On termination we return your data in a structured export and then delete it on an agreed schedule, backups included.
- Backups and recovery
-
Automated database backups with point-in-time recovery. Recovery objectives are set in the contract; our current capability is a five minute recovery point and a four hour recovery time, tested quarterly.
Access and accountability
- Who can reach your data
-
Access to production is limited to named personnel, granted on the least privilege necessary, and mediated by a restricted deployment channel rather than general shell access. Production is never built from source on the server; release images are built once and promoted through an approval gate.
- Secrets
-
Credentials and keys are held in a managed secrets vault, never in source control, container images or configuration files. Application database roles are scoped per service rather than shared.
- Audit trail
-
Append-only. Authentication events, authorisation decisions including refusals, and changes to records are all recorded. Care records cannot be silently altered; corrections are recorded as corrections with attribution and time. In Cairnova Casework each audit entry also carries the hash of the one before it, so a gap or a rewrite is detectable through an integrity check.
- Monitoring
-
Metrics, logs, traces and alerting across the estate, self-hosted on our own infrastructure. Telemetry is not sent to a third-party analytics provider.
Data protection
For all of our platforms we act as processor on your instructions, under a data processing agreement based on Article 28 of the UK GDPR. We maintain a DPIA register covering each processing activity, which we will share to support your own assessment.
Subprocessors
| Cloud hosting and storage | Amazon Web Services — London, eu-west-2. Compute, database, object storage, backups. |
|---|---|
| Transactional email | Amazon Simple Email Service — London, eu-west-2. |
| Speech to text | Microsoft Azure Speech to Text — UK South. Used by Secura CMS dictation only; no transcript is retained on our servers. Not in use until Secura CMS is deployed. |
| Text messages | GOV.UK Notify (Government Digital Service) — UK. Mobile number and message text; never health information. Used by Secura Excursions for family codes and visit updates, off until a council turns it on. Not in use until Secura Excursions is deployed. |
| Phone alerts | Apple Push Notification service, Google Firebase Cloud Messaging and browser push services — outside the UK. They receive an opaque device address and a message encrypted end to end to the phone (RFC 8291), so they can read neither content nor names. Used only for staff who turn alerts on. Not in use until Secura Excursions is deployed. |
| DNS and edge | Cloudflare. Serves this website and fronts our public hostnames; sees connection metadata such as IP addresses, not the contents of your records. |
Cairnova Casework can connect to your own Microsoft 365 tenant for mail, calendar and documents. In that arrangement Microsoft is your processor under your agreement with them, not a subprocessor of ours, and the integration is optional per organisation.
Secura Excursions asks the Met Office for weather forecasts and postcodes.io for a destination’s location, sending a postcode and nothing about any person; neither is a subprocessor. Its optional language-model rewording is off by default. If a customer ever turns it on, the provider must host in the UK or EU, will be added to this table first, and receives only text with personal data removed.
Reporting a vulnerability
If you believe you have found a security issue in any Cairnova system, tell us at info@cairnova.io. We will acknowledge within one working day and keep you informed until it is resolved.
We will not pursue legal action against anyone acting in good faith under this policy: testing only against your own account or data, avoiding privacy violations and service disruption, and giving us reasonable time to fix an issue before disclosing it.
Incident response
In the event of a personal data breach we will notify affected customers without undue delay and in any case within 24 hours of becoming aware, with the information you need for your own regulatory notifications.
Assessing us as a supplier? Email info@cairnova.io for a completed security questionnaire, our DPIA register, the data processing agreement, or an architecture walkthrough with the person who built it.