Security By Design
Customer trust and data security are critical to everything we do at Birdie.
Birdie has achieved ISO27001, Cyber Essentials Plus and exceeds the NHS Data Security and Protection Toolkit standards.
Product security
Secure access
Logging in to Birdie is secured by a one-time authentication link.
Permissions
We enable permission levels within the app to be set for your staff so that only carers who've been invited by you can access a client’s information. These are defaulted to the most secure permission levels and can only be enabled by an affirmative action by you.
Uptime
We have uptime of 99.9% or higher.
Network and application security
Data Hosting and Storage
Birdie services and data are hosted in Amazon Web Services (AWS) facilities (eu-west-2) in the UK.
Failover and DR
Birdie was built with disaster recovery in mind. All of our infrastructure and data are spread across 3 AWS availability zones, these are three different physical data centres, and will continue to work should any one those fail.
Virtual Private Cloud
All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests getting to our internal network.
Backups
Database backups of Birdie’s production system are taken regularly and prior to any major upgrade or configuration change to Birdie’s production environment. These backups allow, in the event of a disaster, the creation of a replica environment within a minimal period of time. Backups are stored in a different AWS environment, with restricted access.
Monitoring
Birdie uses multiple internal and 3rd-party tools for monitoring its production environment and protecting it against potential threats or errors:
- An internal notification mechanism is in place to alert Birdie operations and support teams on different anomalies detected in production.
- AWS analytical tools are configured to continuously monitor Birdie’s production environment status, including server availability, CPU, memory, disk space and other key metrics; the Cloud Monitoring tool also sends alerts to Birdie’s operations team based on preconfigured policies.
- HoneyComb and DataDog are used for live production monitoring via Open Telemetry and logging
- Sentry is used for live production bug and regression tracking
An internal production monitoring dashboard aggregates information from Birdie’s multiple systems and provides Birdie operates with a clear view of it’s production environment status. Birdie also operates a support ticketing system allowing administrators and end-users to report any issues or errors they encounter while using Birdie’s web-based solution.
Permissions and Authentication
All-access to personal confidential data on IT systems can be attributed to individuals and logged. The principle of ‘least privilege’ is applied, so that users do not have access to data they have no business need to see.
We have Single Sign-on (SSO), 2-factor authentication (2FA) and strong password policies on GitHub, Google, AWS to ensure access to cloud services are protected.
Encryption
All data sent to or from Birdie is encrypted in transit using 256-bit encryption. Our API and application endpoints are TLS/SSL only and score an “A” rating on Qualys SSL Labs‘ tests. We also encrypt data at rest using an industry-standard AES-256 encryption algorithm.
Penetration testing
Our dedicated infrastructure team is in charge of ensuring our platform is secure and available at all times. Once a year we engage third-party security experts to perform detailed penetration tests on the Birdie application and infrastructure (last penetration test has been performed in February 2023 by KPMG).
24/7 Incident Response
We recognise that Birdie may be critical to the well-being of your customers and business. That's the reason why we have on-call engineers available at all times.
Birdie implements a protocol for handling security events which includes escalation procedures, rapid mitigation and post mortem. All employees are informed of our policies.
Additional Security features
Training
All employees complete Security and Awareness training quarterly as part of the commitment to the NHS DSP toolkit and compliance to data protection regulations
Our staff by whom the shared personal data is to be handled and processed are appropriately trained to do so in accordance with the Data Protection legislation.
Policies
Birdie has developed a comprehensive set of security policies covering a range of topics including Business Continuity Plan, Incident Response Plan, Privacy by Design Policy. These policies are updated frequently and shared with all employees.
Confidentiality
All employee contracts include a confidentiality agreement.
Payments
All payments made to Birdie go through one of our partners, GoCardless or Stripe. Details about their security setup can be found at GoCardless's security page or Stripe's security page.
Data Protection
We follow the requirements of the CQC, ICO, GDPR and the Data Protection Act 2018. We have a Data Protection Officer (DPO) to oversee and advise on our data management using the ICO Accountability framework. Read our privacy policy to find out how we manage your data when we are a Controller and our Data Processing Agreement when we are a Processor.
Data protection by design
Data protection by design and default is built into all the work we do at Birdie.
We don’t ask for or collect personal data unless it’s absolutely necessary. All of our systems are built to meet the latest regulations. To do so we follow ICO recommendations. We have a dedicated DPO to oversee and advise on our data management (dpo@Birdie.care).
Where possible, we process anonymised data. For example, all data processed by the hardware data pipeline is anonymized. Data is consolidated at the application level.
Data Protection Impact Assessment (DPIA)
DPIAs are performed prior to any new project where data processing is “likely to result in a high risk to the rights and freedoms of data subjects”. We do this to make sure that we’re always in control of our risks and we have procedures in place to mitigate them. We are also on hand to support you with your DPIAs if needed.
We only process clients’ data upon their instruction
Birdie does not control the data inputted by your staff, but rather processes on your behalf. We do use tools (e.g. product analytics) to deliver our services to you and improve the product.
Data Sharing and Transfers
Like most companies, we use a number of third parties as part of our data processing, for example cloud services and technology services. We have a due diligence process with all our vendors and all sub processors of personal data have a Data Processing Agreement in place. Those DPAs are scrutinized by our DPO and must be approved by the senior leadership team prior to signing. Where data is transferred outside of the UK or the EEA, we ensure that appropriate protection and mechanisms are in place, for example Standard Contractual clauses or the UK’s International Data Transfer Agreement/Addendum.
We do not sell your data to anybody.
Questions?
If you think you may have found a security vulnerability, please get in touch with our team at support@birdie.care.
