Security

Our clients, the people who use our services and our staff trust us with their information. Our information security management system (ISMS) sets out how we protect it.

Our ISMS follows ISO/IEC 27001:2022, the international standard for information security management.

How we protect information

• Our applications and data are hosted in the United Kingdom.
• Information is encrypted at rest and in transit.
• Client materials are held in encrypted, access-controlled storage in UK data centres.
• Staff sign in to our services with multi-factor authentication on company-owned devices only.
• Every change to our software is reviewed and tested automatically, including security analysis, before release.
• The software we depend on is checked for known vulnerabilities every day.
• Our public services are scanned from outside for open ports every day, and for web vulnerabilities regularly.
• Our systems are monitored continuously, and security alerts are reviewed every morning.

Policies

Everyone who works for medDigital agrees to follow these policies as a condition of their contract.

Our Statement of Applicability shows every control in ISO/IEC 27001:2022 and the policy that covers it.

Our Information Security Policy sets out our overall approach. The policies below support it.

Organisational

• Organisation, Roles and Risk Policy
• Asset Management and Information Handling Policy
• Supplier and Cloud Services Policy
• Incident Management Policy
• Business Continuity Policy
• Compliance, Legal and Privacy Policy
• Acceptable Use Policy

People

• People Security Policy

Physical

• Physical Security Policy

Technological

• Access Control and Identity Policy
• Endpoint and Mobile Devices Policy
• Operations Security Policy
• Secure Development and Change Policy
• Cryptography Policy
• Backup Policy

Reporting a security issue

If you think you have found a security issue in any of our services, please email security@meddigital.com.