Security and Compliance
Aridhia is committed to protecting and respecting the privacy and the security of your data. We look after your data carefully and are very open about what provisions we have put in place to ensure your data is protected to help you meet your compliance obligations under UK and EU law, international standards, and sector-specific standards.
We hope the following sections will answer your questions on how Aridhia approaches privacy and security.
About Aridhia
Information governance and security management within Aridhia
Aridhia’s General Counsel acts as our Data Protection Officer and Compliance Officer, ensuring that the company is aligned to all internal and external policies, laws and regulations. The General Counsel is also a member of the company board.
Our Information Security manager is responsible for the day to day operational security, risk management and incident management, reporting into the COO.
Our Security Review Board provides oversight and direction relating to information security across all aspects of the Company.
Certifications
Aridhia completed the ISO 27001 certification in June 2019, maintaining this certification through multiple audits, as well as achieving ISO 27701 certification since 2022.
The Azure-hosted Aridhia DRE is HITRUST CSF certified and we also hold several UK certifications, some of which can be seen below.
- Aridhia ISO27001 certificate
- Aridhia ISO27701 certificate
- HITRUST CSF
- ICO Registration Certificate
- NHS Data Security and Protection Toolkit assessment
- Cyber Essentials Plus
- Microsoft compliance documentation
General Data Protection Regulation
Aridhia achieves compliance with GDPR through the implementation of policies and processes which ensure that:
- information is processed on a lawful and transparent basis
- strong data security is achieved through design
- information security governance and accountability within Aridhia is clear
- individual privacy rights are respected.
Software Development Lifecycle
In developing the DRE, Aridhia follows the OWASP Top 10 guidelines and uses tools to ensure our software complies with the OWASP best practice framework and that a “security by design” approach is followed.
We have many measures in place to ensure we follow a secure software development process, including:
- Coding controls are implemented
- Privacy Impact Assessments are conducted
- Frequent regression tests both automated and manual to ensure any work for new features does not introduce security flaws
- Separate and secured development and test environments
- Vulnerability scanning process
- Regular penetration tests are conducted by independent security companies.
Hosting
Aridhia’s services are hosted within the Microsoft Azure cloud platform in the relevant country/region of your choice. Azure has all relevant information security and cloud certifications, including ISO 27001, ISO 27701 and CSA STAR.
All instances of the Aridhia DRE are deployed for specific customer organisations who may adapt our information governance framework to suit their needs. Aridhia is always the data processor and the customer remains the data controller. Your use of the DRE is also governed by an agreement with that customer organisation.
Access to your data
We will not view your data unless you explicitly instruct us to. You may ask us to resolve a problem you are experiencing with the system, in which case we may need to access your workspace – again we will not do this unless you confirm that you are happy for us to do so.
You might ask us to do some technical work to review your files or you may require professional services from our Enablement team. These use cases may require us to access your data – but it will happen only if you ask us to and we have received authorisation from the appropriate individual and/or committee.
About the Digital Research Environment
Security Controls
Within the DRE, security controls include:
- All user access is via HTTPS URL protected by a rooted certificate issues by DigCert SHA2 Secure Server CA, utilising sha256RSA signature algorithm with sha256 signature hashing algorithm. Will only utilise TLS 1.2 protocols or above.
- Encryption in transit. All internal network traffic is protected by HTTPS or, TLS 1.2 or above protocols.
- Encryption at rest. By default, Microsoft Azure encrypts data using FIPS 140-2 compliant 256 AES encryption for storage accounts and virtual machine disks.
- Two-factor authentication is required to access DRE services.
- The secure Workspace boundary is created through a virtual network configuration and enforced through a permissions model.
- An Intrusion Detection System and Intrusion Protection System is implemented with security alerts automatically raised to Aridhia’s Service Desk Team.
- Data upload and data extraction is only permitted through an approval process.
- All uploads go through a malware scanning process.
- Full audit reporting of events.
Operational Processes
The DRE is a managed service, where Aridhia performs the following operations:
- OS patching (scheduled and ad hoc in the event of emergency updates)
- Nightly back-ups of the environment
- All support teams have separate privileged admin accounts and these require 2FA. All support team actions are logged
- Regular audits of the privileged accounts
- All Aridhia employees who have access to the operational environment go through a criminal record check
- Mandatory security training at inductions and periodic refresher training for all employees
- All changes to the platform are subject to change control
- Incident management and CSIRT processes
- Monthly audit of key ISO27001 controls
- Quarterly BCP/DR exercises.
Contact Information
For public and customer requests relating to security or privacy, or if you wish to report a suspected issue or vulnerability, the details of our Service Desk and OSOs can be found below.
| Job Title | Name | |
|---|---|---|
| Information Security & IT Manager | Charles Campbell | servicedesk@aridhia.com |
| Chief Operating Officer | Robert Bryce | servicedesk@aridhia.com |