Trust & Compliance

Security Overview

Revitaco implements comprehensive security measures to protect your data. Our approach is based on defence in depth, with multiple layers of protection.

Technical Security Measures

• Network Security: DDoS protection and network segmentation
• Application Security: Input validation and secure coding practices
• Data Security: Encryption at rest and in transit, data minimisation
• Identity Security: MFA enforcement, password policies, session management
• Operational Security: Least privilege access and security training

Data Hosting

Your data is hosted in the United Kingdom, ensuring compliance with UK data residency requirements and minimising latency for UK-based users.

Data Residency

All primary data (resident records, care notes, user data) is stored exclusively in UK data centres. No customer data is transferred outside the UK without explicit consent and appropriate safeguards.

Backup and Recovery

• Automated daily backups
• Point-in-time recovery capability
• Backups encrypted and stored securely
• Regular backup restoration testing

Sub-Processors

We use carefully selected third-party service providers (sub-processors) to deliver our platform. Each provider is vetted for security and compliance.

We maintain contracts with all sub-processors that include appropriate data protection obligations. Customers are notified of new sub-processors with at least 30 days notice.

Audit Logging

Comprehensive audit logging is essential for care sector compliance and demonstrating accountability. Revitaco maintains detailed, immutable audit trails.

What We Log

We maintain comprehensive audit trails covering user activity, data access, modifications, and system events. This supports CQC compliance and enables full accountability.

Retention and Access

• Audit logs retained in line with NHS records guidance
• Logs are immutable and tamper-evident
• Accessible to authorised administrators via the platform
• Exportable for regulatory inspections

Certifications & Compliance

We are committed to achieving and maintaining recognised security and compliance certifications relevant to the UK care sector.

Regulatory Alignment

• CQC: Platform designed to support CQC compliance requirements
• UK GDPR: Full compliance with UK data protection legislation
• Data Protection Act 2018: Adherence to UK-specific requirements
• PECR: Compliance with electronic communication regulations