Data & Security

ICO Registration

ReflowAI Limited is registered with the UK Information Commissioner's Office — the independent regulator for data protection in the United Kingdom — under registration number ZC176661.

What this means for you:

• ✓Lawful data processing. We process personal data under a defined lawful basis, in line with UK GDPR and the Data Protection Act 2018.
• ✓Public accountability. Our registration is publicly verifiable on the ICO register — you can check it at any time.
• ✓Right to complain. If you are ever unhappy with how we handle your data, you have the right to raise a complaint directly with the ICO.

View our entry on the ICO register →

Certified

Cyber Essentials

Cyber Essentials is a UK government-backed certification scheme, operated by the National Cyber Security Centre (NCSC), that verifies an organisation has essential technical defences in place against the most common cyber attacks. Certification is independently assessed and renewed annually.

ReflowAI Limited is Cyber Essentials certified. That means our systems are verified against the scheme's five technical controls:

• ✓Firewalls. Boundary firewalls and internet gateways that block unauthorised access.
• ✓Secure configuration. Systems configured securely by default, with unnecessary services removed.
• ✓User access control. Access to data and services restricted to the people who need it.
• ✓Malware protection. Defences against viruses and other malicious software.
• ✓Security update management. Software patched promptly so known vulnerabilities are closed.

API Access & Integrations

The API is currently in early access with selected customers. Full API documentation will be available at docs.fitforaudit.co.uk.

Fit for Audit offers an open, documented API so you can access your own compliance data securely. Access is controlled, least-privilege by default, and revocable at any time.

• ✓Scoped access tokens. Each key is limited to exactly what it may read or write, shown once at creation, and revocable instantly.
• ✓OAuth 2.0. For approved partner apps and integrations, using the authorization-code flow.
• ✓Signed webhooks. Every event we send is cryptographically signed (Standard Webhooks) so you can verify it came from us.
• ✓Encryption in transit. HTTPS / TLS 1.2+ only.
• ✓Versioned and supported. Changes are versioned with a published support window, so your integrations don’t break unexpectedly.

Public compliance badge (optional). When you enable it, your aggregate Fit for Audit score can display on your own website. It exposes that single number and nothing else — no resident, patient, pupil or staff data is ever included. It is opt-in per site and can be switched off at any time.

All API access is subject to the same UK GDPR and Data Protection Act 2018 obligations as the rest of the platform, and is covered by your data processing agreement with ReflowAI Limited.

Working Towards ISO 27001

ISO/IEC 27001 is the leading international standard for information security management systems (ISMS). It requires an organisation to systematically identify, assess, and manage information security risks on a continuous basis — and to prove it through independent, accredited audits.

We are currently working towards ISO 27001 certification. We do not yet hold it — and we will not claim it until an independent auditor says we have earned it. Building our ISMS to the standard now means stronger risk management, documented security controls, and continual improvement baked into how we operate every day.

We will update this page as soon as certification is achieved. Questions in the meantime? Email enquiries@reflowai.co.uk.