"Encryption at rest. TLS in flight. Annual audit. Quarterly pen-test. Immutable log."
All client data, supplier data, and dPRN records are encrypted at rest (AES-256) and in transit (TLS 1.3). Truth Ledger entries are SHA-256 sealed. Annual external audit, quarterly internal pen-test, monthly access review. Every read of regulated data is logged.
Sealed: 12 April 2024·Owner: Information Security Officer · Red Team·Weight: Foundational · Light
AES-256
At rest
TLS 1.3
In flight
4×/yr
Pen-tests
Signature Diagram · STACK
📝 Real Example · Numbers · Names
In the field
Q1 2026 audit conducted 04-08 March by external firm. 47 controls tested. 0 critical findings. 2 medium (action plan filed). 12 low (closed within 30 days). Annual report filed with Sovereign 12 March 2026. Cost £8,400.
▸ Triggers · When This Fires
New client onboarded (data ingress)
Quarterly audit window opens
Suspected breach event detected
⚠ Consequence · If Broken
A breach without these controls means GDPR fines (up to 4% turnover), client litigation, regulator investigation, and reputational collapse. The £450 floor cannot survive a data scandal.
All client data, supplier data, and dPRN records are encrypted at rest (AES-256) and in transit (TLS 1.3). Truth Ledger entries are SHA-256 sealed. Annual external audit, quarterly internal pen-test, monthly access review. Every read of regulated data is logged.