Security
Your data never trains or improves any AI model. Inference runs on Google Vertex AI in the EU; prompts and outputs are never stored or used for training. Contractually guaranteed under a processor agreement.
CompliMind processes no patient-identifiable data at any stage. The platform is GDPR compliant and designed to process minimal information for access control and audit.
Trust and engagement data is never sold or shared. Subprocessors act only under data processing agreements, with no independent access.
Every answer to a regulation question includes a traceable source, with the page number, exact cited paragraph, and a link back to the original document.
All primary storage and processing takes place in the United Kingdom, using UK South and West for resilience. Limited transient processing for authentication and AI inference occurs in the EU or EEA.
AES-256 encryption applied to all stored data.
Logical separation per Trust, so data stays private across every organisation and engagement.
Regular independent penetration testing. The most recent assessment returned no critical and no high-severity findings.
Regular automated backups of the database and document storage, with tested restoration procedures and a 99.9% platform availability target.
A documented and rehearsed incident response process: incidents are triaged, contained, investigated, and reported to the Trust without undue delay, followed by post-incident review.
Centralised logging and alerting, with regular review of privileged actions and high-risk events.
Data is retained for the duration of the Trust’s contract. On instruction, accounts and personal data are securely deleted following NIST SP 800-88–aligned procedures, with export and written confirmation of deletion on contract end.
ISO 27001 / ISO 42001 and ISO 9001 / ISO 14001 certificates: available on request.
Available on request.
Standards Exceeded evidence available via the external DSP Toolkit reference.
Available on request.
Available on request, including a full subprocessor list with DPAs and certifications.
Is CompliMind ISO 27001 and ISO 42001 certified?
Is CompliMind approved for use in the NHS?
Does CompliMind store patient or clinical data?
Where is CompliMind data hosted?
Can we upload our own policies and documents, and who can see them?