Trust Centre
Written to be checked, not believed.
Three categories, kept deliberately apart: what is implemented and tested, what depends on how an environment is configured, and what ClaimCore does not hold.
Before anything else
ClaimCore holds no external certification or accreditation. Not ISO/IEC 27001, not Cyber Essentials, not SOC 2. It has not been penetration tested by a third party and has no paid bug bounty.
Every control described below is real, implemented and covered by tests — and none of it has been examined by anybody outside ClaimCore. If independent certification is a hard requirement for your organisation, ClaimCore does not meet it today.
Implemented and tested
Tenant isolation
PostgreSQL Row Level Security on 72 tables, with both read and write policies. The application connects as a database role that owns nothing and cannot bypass them — which is what makes the policies apply to it, since PostgreSQL exempts a table's owner from its own policies.
Access control
Five roles across 49 discrete permissions, plus teams, branches and per-person claim visibility as an independent axis. Rank is checked separately from capability, so nobody can act on somebody more senior.
Authentication
Multi-factor authentication, Microsoft Entra ID single sign-on, a lockout counter held in the database rather than in process memory, and deactivation that takes effect on the next request.
Encryption
TLS in transit, provider encryption at rest, and AES-256-GCM field-level encryption on intake payloads — which carry National Insurance numbers, dates of birth and injury detail.
Document security
Ownership checked on every download, magic-byte inspection at upload rather than trusting a declared content type, and one function setting response headers so an uploaded file cannot execute in your origin.
Audit
Before-and-after values on recorded changes with the actor and their address, viewable in the product. A separate platform audit log for ClaimCore staff actions, which the application role cannot read.
Support access
A ClaimCore engineer reaching your data must state a reason, receives a bounded time window, and has every action inside it recorded against that session.
UK GDPR
Subject access export, per-firm retention policy with a sweep, erasure that removes stored objects as well as rows, and the privacy notice shown at intake stored with the submission.
Backup and recovery
Continuous backup with point-in-time restore, plus a single-tenant restore so your data can be recovered without rolling back anybody else's. Rehearsed rather than documented.
Testing
2,151 automated tests on every change, including a browser suite that forges cross-tenant requests rather than trusting that a hidden button is a control.
Depends on the environment
Three controls are built and tested, and whether they are active depends on how a given deployment is configured: Row Level Security enforcement, which requires the application to connect as the non-owner role; object storage, which must point at S3-compatible storage rather than a local filesystem; and the separation of the application and platform database connections.
All three are reported by name by the running system. Ask us for the readiness output for the environment your data would live in rather than accepting an assurance — we would rather you did.
Not held
- ISO/IEC 27001
- Cyber Essentials
- Cyber Essentials Plus
- SOC 2
- Third-party penetration test
- Paid bug bounty programme
- Industry membership or accreditation
- Independent audit of any kind
Both Cyber Essentials and ISO/IEC 27001 are achievable and neither has been attempted. If your procurement process requires one, tell us which and when — that is a conversation about sequencing, not one where we will claim something we do not have.
Documents and contacts
Send us the security questionnaire before the demo.
We would rather answer your IT team's questions early than discover them in week six of a procurement.