Security & compliance
you can trust
CompliMind is built to meet the most rigorous NHS information governance standards. Everything you need to assess our security posture is here.
All systems operational
ISO 27001 & 42001
ISO 9001 & 14001
Cyber Essentials Plus
DSP Toolkit
ICO Registered
Certifications
Certifications & assurance
Independent certification from accredited bodies covering information security, AI management, and NHS data governance.
🔐
ISO 27001:2022
Information Security Management System - IMS Certified
Active
🤖
ISO 42001:2023
AI Management System - IMS Certified (joint with ISO 27001)
Active
✅
ISO 9001:2015
Quality Management System - IMS Certified
Active
🌿
ISO 14001:2015
Environmental Management System - IMS Certified
Active
🛡️
Cyber Essentials Plus
NCSC-backed - independently tested and certified
Certified
🏥
DSP Toolkit
NHS Data Security & Protection Toolkit - Org: O1K2Q
✓ Compliant
📋
ICO Registration
Registered as a data controller with the ICO
Registered
🔍
Penetration Testing
Web App & AI Security Assessment - Citation Cyber, Nov 2025
✓ Completed
Security
Technical security
Hosted on Microsoft Azure UK, following NHS cloud security standards throughout.
Hosting & Infrastructure
- Microsoft Azure UK South and UK West (dual-region resilience)
- Web portal and API on Azure App Service - HTTPS only (TLS 1.2+)
- Azure Blob Storage for documents - encrypted at rest
- PostgreSQL database for user profiles, audit logs, session data
- Azure Document Intelligence for content processing
- Azure Cognitive Search for indexing and retrieval
- 99.9% platform availability target - Azure infrastructure SLA
Encryption & Key Management
- All data in transit: TLS 1.2+ across all public and inter-service endpoints
- All data at rest: AES-256 encryption (Azure-managed keys)
- Application secrets in secure config stores with rotation procedures
- HTTPS-only session cookies - short-lived, no role information embedded
- Backend role enforcement on every request; token revocation on role change
Authentication
- Firebase Authentication (EU region) for login and session tokens
- Minimum 15-character password policy enforced platform-wide
- MFA mandatory for all internal CompliMind staff accounts
- Tokens carry no role information - all checks server-side
- Immediate token revocation on account suspension or deletion
- Accounts provisioned only on Trust instruction
Logging & Monitoring
- Centralised logging via Azure Monitor and Log Analytics
- Auth events, authorisation decisions, admin actions, data access all logged
- Timestamp, actor, and outcome captured for every audit event
- High-risk and privileged events reviewed regularly; anomalies investigated
- Documented incident response with Trust notification without undue delay
- Post-incident review after every significant event
Penetration Test - Citation Cyber, November 2025
Web Application & AI Security Assessment. Ref: COM281025ST. No critical or high severity findings.
Categories: Information Disclosure, Authentication, Secure Configuration, Access Control, Cryptographic Issues. AI Assessment: 0 medium, 0 high, 0 critical.
Role-Based Access Control (RBAC)
Every action is authorised at the API layer and logged. The NHS Trust is the data controller and directs all user provisioning and removal.
Role
Intended Holder
Core Capabilities
Manage Users?
User
NHS EFM staff
View/search; create documents; upload permitted files; invite/deactivate guests
No
Champion
Trust-appointed
All User rights; invite/deactivate Users and Guests within the Trust tenant
Limited
Guest
Invited external / temporary
View-only of explicitly shared items; cannot browse wider tenant data
No
DB Manager
Trust-appointed
All User rights; manage Trust documents (add, modify, delete)
No
Backup & Disaster Recovery
- Regular automated backups of PostgreSQL and Blob Storage snapshots
- Tested restoration procedures in place
- Low-hour RPO; same business day RTO for critical data
- Resilient dual-region design (UK South + UK West)
- Non-clinical - Trusts maintain primary records independently
AI Controls (Vertex AI)
- RAG-powered - AI responses always cite source documents
- Zero data retention: inference-only, no prompts stored or used for training
- Data minimisation: only minimum context included in each AI payload
- Processing in EU data centres only (Sweden) - no persistent storage outside UK
- AI outputs are advisory only; human verification required
Data Protection
Data protection
CompliMind does not process patient data. Only minimal staff identifiers are handled, in accordance with UK GDPR.
Data Collected
- Personal data (staff only): name, email, job title, activity logs
- Content: estates policies, regulatory guidance, local procedures
- Queries: user search questions and compliance queries
- Operational metadata: search indexes, logs, telemetry
- No patient data is processed - the platform is non-clinical
Data Residency
- Primary storage and processing: Azure UK South / UK West
- Authentication (Firebase): EU region - transient only
- AI inference (Vertex AI): EU/EEA (Sweden) - zero persistent storage
- Analytics (PostHog): EU/EEA - product improvement only
- LLM traceability (Langfuse): EU/EEA - continuous improvement
- No data permanently stored outside the United Kingdom
Controller / Processor
- NHS Trust acts as Data Controller
- CompliMind acts as Data Processor
- Accounts created, modified, deleted only on Trust instruction
- Strict logical tenant isolation - cross-tenant access not possible
- Object-level access control enforced at the backend on every request
- DPIA completed with multiple NHS organisations; available on request
Retention & Deletion
- Data retained for duration of Trust contract or operational need
- Secure deletion on Trust instruction - accounts and personal data removed
- Erasure following NIST SP 800-88 procedures
- Pointers, indexes, and storage securely overwritten by provider lifecycle
- On contract end: export available on request + written deletion confirmation
Subprocessors
Microsoft Azure
Hosting, blob storage, cognitive search, PostgreSQL, monitoring
📍 UK (primary)
Google Cloud
Firebase Authentication (session management); Vertex AI - zero data retention
📍 EU/EEA
PostHog
Platform analytics for product development and improvement
📍 EU/EEA
Langfuse
LLM traceability and continuous AI improvement monitoring
📍 EU/EEA
Risk Management
Risk register
Key risks assessed for the CompliMind platform and the controls in place to address them.
| Risk |
Likelihood |
Severity |
Mitigation |
Owner |
| Unauthorised access (stolen credentials) | Unlikely | Moderate | Strong password policy, HTTPS-only tokens, backend role enforcement, audit logging | CompliMind |
| Data leakage / tenant boundary breach | Unlikely | Major | Logical tenant isolation, object-level access control, backend validation, no cross-tenant queries | CompliMind |
| Misuse of AI outputs (inaccurate summaries) | Possible | Moderate | Advisory-only outputs, zero data retention, traceable citations, user verification required | Trust E&F |
| Service downtime | Unlikely | Minor | Azure 99.9% SLA, high-availability design, disaster recovery testing | CompliMind |
| Function creep / unintended data exposure | Unlikely | Moderate | AI does not override user permissions; RBAC enforced on all surfaced data; IG training for staff | Trust IG Lead |
| Inadequate user deprovisioning | Unlikely | Minor | Champion dashboards for access revocation; backend token invalidation on disablement | Trust Champions |
| Subprocessor risk (Azure, Google) | Unlikely | Major | ICO registration, DSPT compliance, contractual IG clauses, UK/EU hosting, adequacy safeguards | CompliMind |
| Insufficient staff awareness | Possible | Minor | IG and acceptable use training at onboarding, tutorial page, escalation pathways | Trust IG / CM |
| Data transfer outside UK (Sweden, EU) | Unlikely | Moderate | EEA adequacy applies; TLS encryption; no permanent storage; adequacy decisions monitored | CompliMind |
| Contract termination / decommissioning | Unlikely | Major | Secure deletion per NIST SP 800-88, Azure wipe protocols, written confirmation to Trust | CompliMind |
About
About CompliMind
Company structure, NHS deployments, and governance framework.
Company Information
- Legal name: CompliMind Ltd. (formerly INNEX.AI)
- Companies House: 15467857
- Registered address: Canterbury House, 1 Royal Street, London SE1 7LL
- UK-registered organisation
- CEO: Carl-Magnus von Behr - carl@complimind.co.uk
- CTO: Dr. Jan Blümel - jan@complimind.co.uk
NHS Deployments & Validation
- Piloted at NHS Trusts in Cambridge, Birmingham, Newcastle, Somerset, Southampton, and Liverpool
- User feedback confirmed time savings and improved compliance confidence
- DPIA completed with multiple NHS organisations - available on request
- DTAC assessment submitted with supporting user research documentation
- Non-clinical platform - no clinical trials required
Governance Policies
- Information security policy - documented and maintained
- Privacy and data protection policy - aligned to UK GDPR
- Incident response policy - with Trust notification obligations
- Acceptable use policy - provided at user onboarding
- Staff IG and security awareness training programme
- Dual approval required for elevated internal access privileges
User Lifecycle Management
- Joiners: Trust submits authorised details; account created; guidance provided
- Movers: Role change on Trust request; permissions updated; previous tokens revoked immediately
- Leavers: Trust notifies CompliMind or Champion disables; access blocked immediately; deletion scheduled