Trust & Compliance

Security Overview

Revitaco implements comprehensive security measures to protect your data. Our approach is based on defence in depth, with multiple layers of protection.

Technical Security Measures

• Network Security: DDoS protection and network segmentation
• Application Security: Input validation and secure coding practices
• Data Security: Encryption at rest and in transit, data minimisation
• Identity Security: Password policies and session management
• Operational Security: Least privilege access and security training

Data Hosting

Our database is hosted in the United Kingdom on Supabase (PostgreSQL), in the London region, ensuring compliance with UK data residency requirements and minimising latency for UK-based users. We hold no customer data today; the platform currently contains demonstration data only.

Data Residency

All primary data (resident records, care notes, user data) will be stored exclusively in our UK (London) database. No customer data will be transferred outside the UK without explicit consent and appropriate safeguards.

Backup and Recovery

No customer data is held yet. Before any customer data is onboarded, we will ensure our database platform provides:

• Automated daily backups
• Point-in-time recovery capability
• Backups encrypted and stored securely
• Regular backup restoration testing

Sub-Processors

We use carefully selected third-party service providers (sub-processors) to deliver our platform. Each provider is vetted for security and compliance.

This list reflects the services in use today. Additional providers will be added here before they process any customer data. We maintain contracts with all sub-processors that include appropriate data protection obligations. Customers are notified of new sub-processors with at least 30 days notice.

Audit Logging

Comprehensive audit logging is essential for care sector compliance and demonstrating accountability. Revitaco maintains detailed, immutable audit trails.

What We Log

We maintain audit trails covering administrative and configuration changes, billing events, compliance document uploads, and incident records. This supports CQC compliance and enables accountability.

Retention and Access

• Audit logs retained in line with NHS records guidance
• Logs are append-only and immutable by design
• Accessible to authorised administrators via the platform
• Viewable and filterable in-platform for inspections

Certifications & Compliance

We are committed to achieving and maintaining recognised security and compliance certifications relevant to the UK care sector.

Regulatory Alignment

• ICO Registration: JG Core Ltd, trading as Revitaco, is registered with the Information Commissioner's Office (registration ZC079115)
• CQC: Platform designed to support CQC compliance requirements
• UK GDPR: Full compliance with UK data protection legislation
• Data Protection Act 2018: Adherence to UK-specific requirements
• PECR: Compliance with electronic communication regulations