Security & compliance,
built for cardiac data.

Clinical system of record — patient records, ECG documents and signed reports

• ISO/IEC 27001:2022
• Cyber Essentials Plus
• NHS DSPT
• PCI DSS v4.0.1
• GDPR
• ICO-registered

Our patient records sit with a UK clinical-software provider certified to the standards the NHS itself asks for. Semble adds third-party penetration testing, a web application firewall, DDoS protection, endpoint detection and response, data-loss prevention and least-privilege access control, under a named Data Protection Officer.

Authentication, pipeline & billing state, edge functions, ECG file staging and in-flight patient data

• SOC 2 Type 2
• ISO 27001
• HIPAA (under BAA)

All data encrypted at rest with AES-256 and in transit with TLS, regular third-party penetration tests, continuous dependency and secret scanning, DDoS protection and point-in-time recovery backups. Our project is pinned to the London region, so identifying data never leaves the UK.

Hosted checkout & invoicing — no card data stored by CardioBridge

• PCI DSS Level 1 Service Provider
• SOC 1 Type II
• SOC 2 Type II
• SOC 3
• EU–US DPF (UK extension)

The highest certification level in the payments industry, validated annually by an independent assessor. Card numbers are AES-256 encrypted inside a segregated environment, TLS 1.2+ is enforced, and Stripe runs a public bug-bounty programme alongside regular penetration testing and red-team exercises. A card number never reaches CardioBridge.

Transactional & account email

• SOC 2 Type II
• GDPR
• EU–US DPF (UK extension)

We send from Resend's Ireland region, but Resend stores account data and delivery logs in the United States — so we hold a Data Processing Agreement with Standard Contractual Clauses, and Resend is certified under the EU–US Data Privacy Framework and its UK extension. Only a name and email address are ever involved: no ECG data, no reports, no clinical detail.

Static frontend hosting — zero patient data at rest

• SOC 2 Type II
• ISO 27001
• GDPR

Independent OWASP-based penetration testing, pre-deployment secret and authentication scanning, row-level security and a third-party risk-management programme. Base44 serves the public website and application shell only — every request for clinical data goes to our UK backend, not to the host.

Source-code hosting

• SOC 1 Type 2
• SOC 2 Type 2
• ISO/IEC 27001:2022
• CSA STAR Level 2
• PCI DSS AoC

GitHub also publishes a CSA CAIQ self-assessment and quarterly bug-bounty reports. It holds our source code and CI pipeline — no patient data of any kind is stored there, and every change ships through automated static analysis, dependency and secret scanning before release.

Public-website analytics only (Analytics & Tag Manager) — never the clinical application

• ISO/IEC 27001
• Consent Mode v2

Google Analytics is inside Google's ISO/IEC 27001 certification, audited by EY CertifyPoint. We list it because it is a sub-processor even though it never touches clinical data: it loads only on public marketing pages, only after you opt in across the UK and EEA, and our code refuses to send a page view for any signed-in route.

Advertising pixel on the public website — never the clinical application

• EU–US Data Privacy Framework
• UK transfer addendum
• Advertising tool, not a security vendor

This one is an advertising pixel for campaign attribution, and we are not going to dress it up as anything else. It exists on public pages only, loads nothing at all until a UK or EEA visitor opts in, honours Global Privacy Control, and is blocked from every signed-in and patient-facing route in code.

DNS

• ICANN-accredited registrar
• WebTrust-audited certificate authority
• Publishes no SOC or ISO 27001 audit

GoDaddy states plainly that it is not audited for SOC or SSAE 18, and we would rather show you that than leave it off the list. Its scope here is a domain name and its DNS records — it holds no patient data, no credentials and no clinical content, and any change to those records is protected by registrar lock and multi-factor authentication on our account.