PICMS protects customer data with UK data residency, AES-256 encryption, and aligned ISO 27001 controls. We use our own platform to manage our ISMS — and we're publishing the journey.
How we keep your compliance data safe.
All customer data is stored in AWS eu-west-2 (London): Postgres, S3 files and the Supabase vectors. When an AI feature runs, the text it needs is processed by our AI providers in the United States, under the UK addendum to the EU Standard Contractual Clauses. They do not use it to train their models. An organisation can instead have its AI processing kept in London on AWS. See Sub-processors below.
At rest: AES-256 (AWS RDS & S3 server-side encryption).
In transit: TLS 1.2+ on every connection.
Application secrets encrypted with AES-256-GCM, keyed to the platform.
Auth0-backed identity. Supports SSO, MFA (enforced for admin users), and OIDC. Session tokens scoped to organisation with RBAC — consultants, admins, staff, auditors, viewers.
Every query is scoped to the customer's organization_id, and the most sensitive tables (documents and the People vault) also carry Postgres row-level security. Isolation is covered by automated tests on every release and by our regular internal security reviews.
DSAR workflow, right-to-erasure tooling, an audit trail of changes to records and of access to People vault documents. DPA available on request. We are registered with the ICO (UK Data Protection).
Every create, update, and delete logged with user identity, timestamp, and diff. Immutable activity timeline. Exportable for external auditors.
Automated RDS snapshots every 24h with 30-day retention. Point-in-time recovery to any second in the last 7 days. Tested monthly via restore drill.
Dependabot scans every push with automatic dependency patching. Automated security testing runs weekly — static analysis (SAST) across the backend and dynamic testing (DAST) against production, with findings triaged and remediated on a tracked pipeline. An independent third-party penetration test is scheduled ahead of ISO 27001 certification (Q3 2026). Responsible disclosure: security@picms.com — see /.well-known/security.txt.
Radical transparency: where we are, where we're going.
The stack that runs your compliance.
Every third party with access to customer data, what they do, and where the processing happens. Notified 30 days in advance of any addition.
All sub-processors process customer data under signed contractual data-processing terms (UK GDPR Article 28). Data crossing the UK→US border is protected under the UK addendum to the EU Standard Contractual Clauses. The full list is also published in our Privacy Policy §5 and is referenced in our standard Data Processing Agreement.
Adding or changing a sub-processor: we notify you at least 30 days in advance via email to your account contact. If you have a contractual right to object, you may exercise it by contacting privacy@picms.com.
Today's cryptography won't survive the quantum era. For a compliance platform holding audit evidence, signed sign-offs, and consultant IP with 5+ year retention, that matters now — an adversary can harvest encrypted data today and decrypt it later. We've already done the work to be ready.
No asymmetric cryptographic primitives are invoked in PICMS application code. Transport-layer TLS and identity-token verification inherit the AWS and Auth0 cryptographic stacks, which are on their own published PQC roadmaps. Full inventory at picms.com/security/cbom.
Symmetric cryptographic operations route through a single audited wrapper module — the foundation we need to migrate algorithms quickly when NIST post-quantum primitives become available in our runtime.
Weekly portable data exports (agent memory, training, fleet learnings) carry HMAC-SHA-256 signatures + plaintext SHA-256 fingerprints in sidecar files. Tamper-evident, verifiable, versioned scheme.
Machine-enforced retention on long-lived data. Daily cron shrinks the hot surface area that could ever be harvested, with an auditor-friendly retention log.
Annex A 8.24 — Use of cryptography
A.6.2.8 + A.8.3 — AI resource & data management
ML-KEM / ML-DSA adoption path
Harvest-Now-Decrypt-Later mitigation
Public Cryptographic Bill of Materials at picms.com/security/cbom — or email security@picms.com for a signed PDF copy.
We're happy to share our penetration test reports, DPA template, and responsible disclosure policy. Email the team directly.
Customer data is stored in AWS eu-west-2 (London, United Kingdom). Database storage (RDS PostgreSQL), object storage (S3), AI vector embeddings (Supabase) and search indexes all reside in eu-west-2. Organisations can switch on UK-only AI processing, which runs Claude AI, photo analysis, dictation and read-aloud answers on AWS in London instead of our US AI providers. Indexing documents for search (OpenAI), email delivery and payments process limited data in the United States either way, under the UK addendum to the EU Standard Contractual Clauses; each is listed with its location under Sub-processors.
All data is encrypted at rest with AES-256 (RDS, S3, document storage, AI embeddings). In transit, TLS 1.2+ enforced across all endpoints. Sensitive admin credentials and integration tokens use AES-256-GCM authenticated encryption with rotated keys. PICMS shipped a Post-Quantum Cryptography sprint in April 2026 introducing crypto-agile architecture, HMAC-signed S3 exports, and a published Cryptographic Bill of Materials.
PICMS holds Cyber Essentials certification (certified August 2026, assessed by IASME, certificate 54c71e02) and is registered with the ICO for data protection (ZC221368). ISO 27001 is the next step: PICMS is in active preparation with a target audit window in Q4 2026, and already operates the technical and management controls Annex A requires. We publish our progress transparently rather than claiming a status we don't hold.
PICMS is a data processor under UK GDPR when handling customer-controlled data. We provide a Data Processing Agreement (Article 28 controller-processor terms) on the data-processing page, document our sub-processors transparently, and support standard data subject rights workflows (access, rectification, erasure, restriction, portability). Customer data subject requests can be fulfilled via the data export endpoints; deletion requests are honoured within 30 days. Breach notification to the controller is within 24 hours.