Security and governance
What we hold, what we don't, and what's planned
Information governance and security teams need precise answers. This page sets out EquiCare's current position plainly, including the assurances we do not yet hold.
Assurance status
| Assurance | Status | Detail |
|---|---|---|
| Cyber Essentials | Held | JGME Consulting UK Ltd, awarded August 2026. Certificate available on request. |
| Cyber Essentials Plus | Held | JGME Consulting UK Ltd, awarded September 2026. Certificate available on request. |
| Independent penetration test | Held | Completed by a CREST-accredited individual tester. A further test is planned before pilot go-live. |
| AI assurance pack | Held | Completed in October 2026. |
| Accessibility audit of the EquiCare product | Held | Completed in October 2026 by JGME internal teams. This covers the product, not this website. |
| ISO/IEC 27001 | In progress | Expected first quarter of 2027. JGME and EquiCare are not yet certified. The Microsoft Azure services EquiCare runs on are certified; that certification covers Microsoft's cloud, not JGME or EquiCare. |
| Clinical and care safety case (DCB0129) | In progress | EquiCare is implementing a structured clinical and care safety risk management framework aligned with NHS England's DCB0129 standard. This includes assessing risks associated with AI-supported information gathering, safeguarding flagging and triage, with qualified practitioners retaining responsibility for all statutory decisions. |
| Council-ready DPIA template | In progress | In development. We support your own DPIA in the meantime. |
| NHS Data Security and Protection Toolkit | Planned | Not yet submitted. Expected first quarter of 2027. |
| DTAC assessment | Planned | Expected first quarter of 2027. |
| Case management integrations | Planned | No production Liquidlogic or Mosaic integration today. |
Controls in place today
UK hosting
EquiCare is hosted on Microsoft Azure in the UK. Case records, assessments, call recordings and attachments are stored in Azure UK South. Platform policy prevents services being deployed outside UK South and UK West. Each council has its own separate database.
EquiCare data is backed up automatically by Azure SQL Database: full backups weekly, differential every 12 to 24 hours, and transaction-log backups every 5 to 10 minutes (point-in-time restore per tenant database). Backups are stored geo-redundantly in the primary region (UK South) and replicated to its paired UK region (UK West), so all data stays in the UK.
Identity and access
Staff sign in with their own council Microsoft Entra ID account, using single sign-on, multi-factor authentication and your Conditional Access policies. Access is role-based and mapped to council-managed groups. Privileged admin access is time-bound, approved and logged.
AI processing
EquiCare's AI features run on Microsoft Azure OpenAI and Azure AI Foundry, in UK South. Nothing is shared with OpenAI or other model providers, and nothing is used for model training. Microsoft may keep abuse-monitoring logs for up to 30 days within Azure.
Data protection roles and retention
For the EquiCare service, the council is the data controller and JGME Consulting UK Ltd is the data processor, under a data processing agreement. Retention and data flows are agreed with each council.
If a council hasn't set its own retention, EquiCare keeps case records (assessments and notes) for 7 years, and call recordings and transcripts for 12 months. Each council can change these within platform-enforced limits, and audit logs are kept indefinitely in immutable storage.
Sub-processors
A list of the sub-processors that handle council data, with the country of processing, is available on request.
Documents for your IG team
On request, we provide IG teams with an architecture diagram, a data-flow diagram and EquiCare's audit-event catalogue, and can walk your team through them to support your DPIA.
Bring your IG and security colleagues early
We welcome early conversations with Information Governance, Data Protection Officers, Caldicott Guardians, cyber security and digital teams.
Request a technical and assurance discussion