Trust & security

Comflyant is compliant data-capture infrastructure for UK healthcare. We are the data processor; our customers are the data controllers. We are not a medical device — we capture and surface responses, we don't interpret them. This page sets out our compliance posture and the security controls we have in place.

Compliance & standards

• UK GDPR & Data Protection Act 2018 — we process personal data only as a processor, on our customers' documented instructions.
• ICO registered — registered with the Information Commissioner's Office with the data-protection fee paid.
• Data Processing Agreement — a UK GDPR Article 28 DPA is available to every customer.
• NHS Data Security & Protection Toolkit — self-assessment in progress, working towards a "Standards Met" status.
• Cyber Essentials — planned; available on request to customers whose procurement requires it.
• ISO 27001 — on our roadmap as we scale.

Data residency — UK only

All data and infrastructure remain in the United Kingdom. Every resource runs in a London region; non-UK and multi-region locations are prohibited by policy and enforced in our infrastructure. Patient and recipient data never leaves the UK.

Our primary data store is in the UK. The SMS carrier path and staff email use UK-resident services from a US-owned provider, so for those paths this is UK residency rather than full sovereignty — and neither receives patient data beyond what is strictly required to deliver a message.

How we protect your data

• Encryption — all data is encrypted in transit and at rest.
• Staff access — multi-factor authentication is mandatory, and access is governed by role-based access control.
• Customer & recipient access — API access uses revocable, hashed API keys; recipients receive a signed, single-purpose link rather than a shared password or account.
• Tenant isolation — every record is scoped to one organisation, and cross-tenant access is rejected.
• Credentials & secrets — passwords and keys are stored only as hashes, never in plaintext; application secrets are held in a UK-pinned managed vault, and our infrastructure uses short-lived federated credentials rather than long-lived keys.
• Audit logging — security-relevant actions are recorded in an append-only audit log (who, what, when). We do not write patient data to application logs.
• Infrastructure — our database is not reachable from the public internet, responses carry strict security headers, and all input is validated against typed schemas.
• Change management — changes follow a reviewed release process with a staging gate before anything reaches production.
• Backups — data is backed up daily within the UK.

Sub-processors

We engage the sub-processors below to deliver the service. Each is bound by its own data-processing terms, and all recipient (patient) data is confined to UK regions. Customers are notified of changes under the Data Processing Agreement, and material additions carry a right to object.

Sub-processor	Service	Data processed	Region
Google Cloud	Compute, database, secrets, logging, storage	All processed data — recipient names, phone numbers, form answers, message bodies, staff accounts, audit logs	London (UK)
AWS — End User Messaging SMS	Outbound SMS delivery (carrier gateway)	Recipient phone number and SMS message body; delivery-status events	London (UK)
AWS — Simple Email Service (SES)	Transactional staff / auth email	Staff email address and email body. No recipient / patient data.	London (UK)
Stripe	Billing / subscriptions	Organisation billing identity. No recipient / patient data.	Stripe-managed (UK / EU billing entity)

Due-diligence materials

For procurement and security reviews, the following are available on request (under NDA where appropriate): our Data Protection Impact Assessment (DPIA), the signed Data Processing Agreement, our Record of Processing Activities (ROPA), a detailed description of our technical and organisational measures, and current sub-processor terms. Contact our data-protection lead at tayyeb@findingout.co.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email tayyeb@findingout.co. We welcome responsible disclosure, will acknowledge your report, and ask that you give us a reasonable opportunity to remediate before any public disclosure.