Security and compliance

We do not hold ISO 27001, ISO 9001, Cyber Essentials, Cyber Essentials Plus or any other security certification. We have not had an external penetration test that we can show you. We have not completed the NHS Data Security and Protection Toolkit or a Digital Technology Assessment.

Our ICO registration number currently reads [TO CONFIRM]. It will be published here once it has been confirmed.

Box 4 Digital Group Ltd was incorporated on 1 June 2026. It is a new company, so there is no long track record to point to.

The website, the application, the API and their data services all run on one server operated by Box 4, hosted by OVH in Barking, in the UK. That server also hosts other Box 4 websites. The register's own database, cache and search services run in separate containers on that server, and they listen only on the machine's internal loopback address, so they cannot be reached directly from the internet.

We do not use a separate database server, and we do not have a second live site to fail over to. If that server were lost, the service would be restored from backup.

Backups run nightly. Each run takes a database dump of the application, a dump of the website database, the website's content files, the stored files (uploads, PDFs and consignment notes) and a copy of the code. A checksum file is created and a dry run confirms that the copy on the backup store matches. We keep 30 dated folders.

Backups are stored outside the UK. The destination is a Hetzner Storage Box located in Germany. Backups travel to it over SSH. The archives themselves are not encrypted by us before they are sent.

Secrets are excluded from backups and stay on the server. The search index and cache are not backed up, because they can be rebuilt from the database.

In transit: the website, app and API are served over TLS, with a Let's Encrypt certificate covering all of those hostnames. Session cookies are HTTP-only.

At rest: we make no claim of encryption at rest. Our documented set-up does not include encryption of the database, the stored files or the backup archives. If that changes, we will say so here.

Every table holding an organisation's data carries an organisation ID. Postgres row level security is enabled on those tables, and the organisation is set for each request inside a database transaction. The application connects with a database role that has no superuser rights and cannot bypass row level security. The owner role is used for migrations only. A test attempts to read across organisations and must fail.

Access to the application needs a session, held in an HTTP-only cookie. Administrative functions and the supplier portal are separated by role. Uploaded files, PDFs and consignment notes are held in a private store and are never served directly from the web.

Roles are owner, admin, technician, viewer, approver and finance. Sign-in is by email and password with optional TOTP, with single sign-on through Google Workspace and Microsoft 365 on larger plans. Every register change writes an immutable audit entry recording who, when, before and after.

Box 4 staff have a tenant impersonation function for support, and its use is audited.

Runtime secrets sit in a file on the server that is outside the code repository and outside web roots, and it is readable only by root and the service account. On the website, the code is read-only to PHP and only the uploads folder is writable. Plugins and the WordPress core cannot be changed through the admin screens, and minor core releases are applied automatically each day.

The AI assistant uses DeepSeek V4 Flash through Hugging Face. Calls send chemical data and label photographs. Personal data is stripped where identified, but photographs may contain unintended personal information. The provider may process data outside the UK. If the route fails, the assistant fails with an error and no other provider is tried. See AI assistant.

Our current sub-processors are OVH for UK hosting, Hetzner for backup storage in Germany and Hugging Face for AI inference. The list, along with what each receives, is in the data processing terms.

Your organisation is the controller of the personal data in your register, and Box 4 acts as its processor. The data processing terms set out that relationship. Personal data in the register is mostly limited to user names, email addresses and audit entries. Our privacy notice covers data that we hold as a controller.

A data export of your whole organisation is available on request. Consignment notes and disposal records are retained for a minimum of three years and cannot be deleted by users in your organisation, only archived.

If your organisation needs UK-only data residency, certification or encryption at rest, you should treat this page as stating that we do not meet those requirements today. Tell us if any of them would stop you from using the register, because that shapes what we build next. Please do not rely on anything beyond what is written here.