Trust & Compliance

Data & Security

You trust us with compliance data for your school, surgery, or care home. Here is how we protect it — and the independent registrations and certifications that back it up.

Registered Data Controller

ICO Registration

ReflowAI Limited is registered with the UK Information Commissioner's Office — the independent regulator for data protection in the United Kingdom — under registration number ZC176661.

What this means for you:

  • ✓Lawful data processing. We process personal data under a defined lawful basis, in line with UK GDPR and the Data Protection Act 2018.
  • ✓Public accountability. Our registration is publicly verifiable on the ICO register — you can check it at any time.
  • ✓Right to complain. If you are ever unhappy with how we handle your data, you have the right to raise a complaint directly with the ICO.
Information Commissioner's Office logoView our entry on the ICO register →
Certified

Cyber Essentials

Cyber Essentials Certified badge

Cyber Essentials is a UK government-backed certification scheme, operated by the National Cyber Security Centre (NCSC), that verifies an organisation has essential technical defences in place against the most common cyber attacks. Certification is independently assessed and renewed annually.

ReflowAI Limited is Cyber Essentials certified. That means our systems are verified against the scheme's five technical controls:

  • ✓Firewalls. Boundary firewalls and internet gateways that block unauthorised access.
  • ✓Secure configuration. Systems configured securely by default, with unnecessary services removed.
  • ✓User access control. Access to data and services restricted to the people who need it.
  • ✓Malware protection. Defences against viruses and other malicious software.
  • ✓Security update management. Software patched promptly so known vulnerabilities are closed.

Our live certificate, verified in real time by IASME and BlockMark. Click the badge above to view the full certificate on the official registry.

In Progress — Coming Soon

Working Towards ISO 27001

ISO/IEC 27001 is the leading international standard for information security management systems (ISMS). It requires an organisation to systematically identify, assess, and manage information security risks on a continuous basis — and to prove it through independent, accredited audits.

We are currently working towards ISO 27001 certification. We do not yet hold it — and we will not claim it until an independent auditor says we have earned it. Building our ISMS to the standard now means stronger risk management, documented security controls, and continual improvement baked into how we operate every day.

We will update this page as soon as certification is achieved. Questions in the meantime? Email enquiries@reflowai.co.uk.