Yes, absolutely. Verity is built from the ground up to satisfy UK GDPR and NHS Data Security and Protection Toolkit (DSPT) standards:100% UK Data Sovereignty: All database records, audit answers, and application compute run exclusively in Google Cloud’s London (europe-west2) data centre. No customer data leaves the UK.Strict Tenant Isolation: Access is site-locked to your registered CQC Location ID and enforced at the database level—one care provider cannot access or view another provider's audits.Zero AI Model Training: We operate under enterprise zero-data-retention terms. Your audit notes, observations, and action plans are never retained by Google or used to train public AI models.Automated Regulatory Sanitisation: Our AI endpoints enforce strict prompt-level guardrails designed to systematically replace detected resident or staff names with anonymised tokens (e.g. [Resident A], [Staff Member]) within generated action plans and compliance narratives, supporting Caldicott Principles and data minimisation.Continuous Backups: Live data is backed by automated, continuous 7-day Point-in-Time Recovery (PITR) to ensure full business continuity and disaster recovery.
