Now with AI-powered compliance, 37 modules, and industry starter packs from just £59/month.
See What's New →PICMS protects customer data with UK data residency, AES-256 encryption, and aligned ISO 27001 controls. We use our own platform to manage our ISMS — and we're publishing the journey.
How we keep your compliance data safe.
All customer data lives in AWS eu-west-2 (London). Postgres, S3 objects, Supabase vectors — everything. No data leaves the UK without your explicit consent.
At rest: AES-256 (AWS RDS & S3 server-side encryption).
In transit: TLS 1.2+ on every connection.
Application secrets encrypted with AES-256-GCM, keyed to the platform.
Auth0-backed identity. Supports SSO, MFA (enforced for admin users), and OIDC. Session tokens scoped to organisation with RBAC — consultants, admins, staff, auditors, viewers.
Every query scoped to organization_id. Row-level isolation in Postgres. Cross-tenant data access is architecturally impossible — not just policy.
DSAR workflow, right-to-erasure tooling, audit log of every data access. DPA available on request. We are registered with the ICO (UK Data Protection).
Every create, update, and delete logged with user identity, timestamp, and diff. Immutable activity timeline. Exportable for external auditors.
Automated RDS snapshots every 24h with 30-day retention. Point-in-time recovery to any second in the last 7 days. Tested monthly via restore drill.
Dependabot scans every push. Automatic dependency patching. Penetration test planned pre-ISO 27001 certification (Q3 2026). Responsible disclosure: security@picms.com.
Radical transparency: where we are, where we're going.
The stack that runs your compliance.
Today's cryptography won't survive the quantum era. For a compliance platform holding audit evidence, signed sign-offs, and consultant IP with 5+ year retention, that matters now — an adversary can harvest encrypted data today and decrypt it later. We've already done the work to be ready.
Every cryptographic primitive in PICMS is inventoried and classified by quantum vulnerability. Zero RSA, ECC, or ECDSA in application code — our Shor's-algorithm exposure is zero.
Every cryptographic call routes through a single wrapper. Adopting NIST's post-quantum standards (ML-KEM, ML-DSA) becomes a one-file change — not a platform rewrite.
Weekly portable data exports (agent memory, training, fleet learnings) carry HMAC-SHA-256 signatures + plaintext SHA-256 fingerprints in sidecar files. Tamper-evident, verifiable, versioned scheme.
Machine-enforced retention on long-lived data. Daily cron shrinks the hot surface area that could ever be harvested, with an auditor-friendly retention log.
Annex A 8.24 — Use of cryptography
A.6.2.8 + A.8.3 — AI resource & data management
ML-KEM / ML-DSA adoption path
Harvest-Now-Decrypt-Later mitigation
Full quantum readiness report available to customers and auditors on request: security@picms.com
We're happy to share our penetration test reports, DPA template, and responsible disclosure policy. Email the team directly.