PICMS protects customer data with UK data residency, AES-256 encryption, and aligned ISO 27001 controls. We use our own platform to manage our ISMS — and we're publishing the journey.
How we keep your compliance data safe.
All customer data lives in AWS eu-west-2 (London). Postgres, S3 objects, Supabase vectors — everything. No data leaves the UK without your explicit consent.
At rest: AES-256 (AWS RDS & S3 server-side encryption).
In transit: TLS 1.2+ on every connection.
Application secrets encrypted with AES-256-GCM, keyed to the platform.
Auth0-backed identity. Supports SSO, MFA (enforced for admin users), and OIDC. Session tokens scoped to organisation with RBAC — consultants, admins, staff, auditors, viewers.
Every query scoped to organization_id. Row-level isolation in Postgres. Cross-tenant data access is architecturally impossible — not just policy.
DSAR workflow, right-to-erasure tooling, audit log of every data access. DPA available on request. We are registered with the ICO (UK Data Protection).
Every create, update, and delete logged with user identity, timestamp, and diff. Immutable activity timeline. Exportable for external auditors.
Automated RDS snapshots every 24h with 30-day retention. Point-in-time recovery to any second in the last 7 days. Tested monthly via restore drill.
Dependabot scans every push. Automatic dependency patching. Penetration test planned pre-ISO 27001 certification (Q3 2026). Responsible disclosure: security@picms.com.
Radical transparency: where we are, where we're going.
The stack that runs your compliance.
We're happy to share our penetration test reports, DPA template, and responsible disclosure policy. Email the team directly.