Trust & Security

Every account uses unique individual credentials. Accounts are never shared. Multi-factor authentication is enforced on every service where it is available, without exception, using hardware security keys, passkeys or authenticator applications in preference to SMS.

Access is granted on a need-to-know basis and scoped to role. Access to client production data is not a standing permission: it is authorised in writing for a specific task, is time-bound with an explicit end date, and is logged. Access is reviewed quarterly against the current personnel list, and a documented leaver process disables all accounts on departure, rotates shared credentials and terminates active sessions.

All software in use is within vendor support. Automatic updates are enabled wherever available, and security updates rated critical or high are installed within 14 days of release, covering operating systems, applications and dependencies. Application dependencies are monitored by automated vulnerability scanning, with advisories triaged within two working days.

Inbound traffic to our infrastructure is default-deny. Only the ports required to serve web traffic are open, each with a documented business justification and a named approver, reviewed at least annually. Databases and administrative interfaces are not exposed to the internet. Administrative access uses key-based authentication with password authentication disabled.

Every device used for Lluminate work runs full-disk encryption, an always-on software firewall, automatic updates and malware protection, and locks automatically after five minutes. Configuration is managed declaratively and version-controlled, so the installed state is auditable at any point in time.

Data in transit is protected by TLS 1.2 as a minimum, with TLS 1.3 preferred and HSTS enabled. Data at rest, including databases and backups, is encrypted using AES-256. Special category fields in our registry platforms carry additional field-level encryption. Passwords are hashed using a memory-hard algorithm and are never stored in a recoverable form.

Development, staging and production are separate environments with separate credentials. Every change is peer reviewed before it reaches production. Changes touching authentication, authorisation, encryption, tenant isolation or the handling of special category fields require review by a second person with relevant competence.

Secrets are never committed to repositories; automated secret scanning runs on every commit. Multi-tenant platforms maintain tenant isolation by design, with database-per-tenant separation on our patient registry platform.