Trust Centre
Security, privacy an compliance
Fur buyers an security reviewers assessin RODMENA as a supplier, this page shaws the current status neist tae the claims we mak.
Public-sector buying
Appointed RODMENA is an appointed supplier on the Government Commercial Agency’s Artificial Intelligence Dynamic Purchasing System (RM6200). UK public-sector buyers can invite us tae their competitions unner the agreement an gie oot contracts throu it.
- Agreement
- Artificial Intelligence Dynamic Purchasing System (RM6200)
- Contractin authority
- Government Commercial Agency
- Oor status
- Appointed supplier
- Appointed
- 7 October 2026
- Agreement runs until
- 23 February 2029
- Agreement page
- RM6200 on the Government Commercial Agency website
Tha greeance page describes the system but disnae leet suppliers. Buyers sees the appyntit suppliers whan they filter the system in their ain accoont.
Ither Government Commercial Agency agreements
We are forby an appointed supplier on thae agreements. UK public-sector buyers can invite us tae competitions run under thaim and gie oot contracts throu thaim.
| Agreement | Appointed | Agreement runs until | Agreement page |
|---|---|---|---|
| Spark Dynamic Purchasing System (RM6094) | 12 October 2026 | 15 February 2029 | RM6094 on the Government Commercial Agency website |
| Quality Assurance and Testing for IT Systems 2 Dynamic Purchasing System (RM6148) | 12 October 2026 | 23 February 2029 | RM6148 on the Government Commercial Agency website |
| Automation Marketplace Dynamic Purchasing System (RM6173) | 12 October 2026 | 15 November 2026 | RM6173 on the Government Commercial Agency website |
| Low Value Purchase System (RM6237) | 22 September 2026 | 31 March 2027 | RM6237 on the Government Commercial Agency website |
Supplier marketplaces
RODMENA is an Approved Supplier on the Constellia Marketplace. Constellia runs procurement for public an private sector organisations, an its clients buy through the suppliers it has approved.
- Marketplace
- Constellia Marketplace
- Run by
- Constellia Public Ltd, London
- Oor status
- Approved Supplier
- Approved
- 19 October 2026
- Evidence
- Constellia’s written confirmation, sent tae buyers on request. www.constellia.com
Security oweriew
RODMENA is a UK saftware companie that bigs fault-tolerant seestems. Traffick tae aa oor services is encryptit in transit, an fowk gets anerly the access their wark needs. We rin an harden oor ain infrastructur. Oor development practice is designed tae haud in failures an recover frae them. Forbye business correspondence we haud wee personal data, an this wabsteid uses nae analytics, trackers or advertisin cookies.
Access control, encryption, secure development, backups, vulnerability management an incident response are covered in detail in oor security whitepaper.
Security contact: security@rodmena.co.uk (see forby responsible disclosure an security.txt).
Text messages fae RODMENA
Text messages frae RODMENA’s platforms, includin RODMENA ID an Futex, are sent anerly frae +44 7822 000922, a nummer we use for nocht else. If a text claimin tae be frae RODMENA comes frae onie ither nummer, it isna oors. Plais report it tae security@rodmena.co.uk. Tae win at us bi phone or text, use +44 7537 179434.
Certifications an compliance
| Certification or assessment | Status | Issued | Expires | Evidence |
|---|---|---|---|---|
| Cyber Essentials Certified by GDAK (G-DAK Cyber Solution Ltd); Cyber Essentials Partner IASME (UK Government-backed scheme). Certificate 00d24b59-7739-4d97-bb66-341ac50ef018. Scope: hale organisation. Profile 3.3 (Danzell) | Certified | 2026-09-30 | 2027-09-30 | Register entry |
| Cyber Essentials Plus IASME (UK NCSC scheme). Planned tae follae Cyber Essentials | Planned | — | — | — |
| ICO Data Protection Registration Information Commissioner's Office. Registration reference ZC202334 (Tier 1); verifie on the public ICO register | Registered | 2026-07-19 | 2027-07-18 | Register entry Certificate (PDF) |
| NHS Data Security and Protection Toolkit (DSPT) NHS England. 2026-27 (version 9) assessment, organisation code (ODS) T6S8P | Standards met | 2026-10-22 | 2028-06-30 | Register entry Certificate (PDF) |
| ISO/IEC 27001 (Information Security) UKAS-accredited certification body. On the roadmap as the company grows | Planned | — | — | — |
| Penetration testing Independent security tester. A summary o scope an findins will be furthset efter the first penetration test | Planned | — | — | — |
Cyber Essentials
RODMENA LIMITED is certified unner the UK Government-backed Cyber Essentials scheme for the hale organisation.
- Certificate
- 00d24b59-7739-4d97-bb66-341ac50ef018
- Scope
- Hale organisation
- Profile
- 3.3 (Danzell)
- Certified
- 30 September 2026
- Recertification due
- 30 September 2027
- Certification body
- GDAK (G-DAK Cyber Solution Ltd), wi IASME as the Cyber Essentials Partner
- Cyber insurance
- Cyber insurance in place. Evidence available on request from security@rodmena.co.uk.
- Verification
- Public certificate record on the BlockMark registry
The certificate confirms that, when assessed, our ICT defences met the Cyber Essentials requirements against commodity cyber attacks. It is not a guarantee that they will remain satisfactory against every attack.
Insurance
Cyber insurance in place. Evidence available on request from security@rodmena.co.uk. The policy comes wi oor Cyber Essentials certificate an runs fur the same period. Subject tae its terms an limit, it pays fur incident response, the costs o handlin a cyber incident (legal advice, IT forensics, data recovery, noatifeein fowk that's affectit an public relations), loss o income while oor systems ir interruptit, data protection investigations an fines (whaur the law permits), an claims fae third pairties efter a data breach or security failure. It disnae cover money stowlins throu cyber-crime or invoice fraud, an it isnae professional indemnity or public liability cover.
Professional indemnity, public liability an employer’s liability cover is in place unner ae policy wi CFC Underwriting, for Lloyd’s syndicates. Cover is pit in place tae the leemits a contract requires an evidencet afore signature.
| Kiver | Status | Details |
|---|---|---|
| Professional indemnity | In place | CFC Underwriting, for Lloyd’s syndicates, £1,000,000 each and every claim. The cover rins frae 1 November 2026 tae 1 November 2027. |
| Public liability | In place | CFC Underwriting, for Lloyd’s syndicates, £5,000,000 each and every claim. The cover rins frae 1 November 2026 tae 1 November 2027. |
| Employer’s liability | In place | CFC Underwriting, for Lloyd’s syndicates, £10,000,000 each and every claim. The cover rins frae 1 November 2026 tae 1 November 2027. |
| Cyber | In place | Rins tae 30 September 2027 alangside the certificate. Insurer an limit on request. |
Privacy an data protection
We haud minimal personal data, boun tae business correspondence. This wabsteid sets nae cookies an rins nae analytics or trackers. Oor Privacy Policy descrives hoo we process personal data. The Article 28 terms we affer are on the Data Processing Agreement page.
DPA requests: legal@rodmena.co.uk · privacy an data-protection questions: privacy@rodmena.co.uk · data-subject requests: gdpr@rodmena.co.uk.
Sub-processors
| Provider | Pörpose | Whaur data is processed |
|---|---|---|
| OVHcloud | Virtual servers fur the production database tier an some application services, an object storage fur encrypted backups | Unitit Kinrick, France and Germany |
| iDNet | Virtual servers fur the wabsteid an application services, an the office connection | Unitit Kinrick |
| Cloud Nord | Servers fur a build runner, alertin an the partner portal | Unitit Kinrick |
| Google Workspace | Staff email, calendars an documents, includin correspondence wi customers | Ireland, Unitit States and ither Google locations |
| Anthropic | Claude Enterprise, the AI assistant RODMENA engineers uise tae operate its systems, that can see operational logs an data | Unitit States |
| GitHub | Source code hostin an continuous integration | Unitit States |
The full register, wi ilka contractin company, the transfer safeguards an the chynges sin 5 October 2026, is on the data processing page. Chynges is annunced at least 30 days ahead in the sub-processor feed.
External services that process nae personal data
RODMENA cmi5 airs its audit chain wi a public RFC 3161 timestamp authority. That service gets a SHA-256 digest o a signed chain heid, aboot ivery fifteen meenits, an only fur a customer whase chain has chynged. Nae personal data, nae identifiers an nae learning records is sent tae it. Whan it cannae be reached, learning, launches, statements an evidence export isnae affected, an anchoring retries on the next pass.
Prism, the model gateway o RODMENA, sends requests tae InferX Technologies, Inc. (Unitit States) fur language-model inference. Nae customer personal data is sent tae it. Afore Prism is uised wi customer personal data, the model will be hostit in the Unitit Kinrick or provydit unner a contract wi transfer safeguards.
Oor domain registrar an DNS provider hauds only domain an zone records.
Responsible disclosure
Gin ye think ye hae foun a security vulnerability in this wabsteid or in a RODMENA product, please email security@rodmena.co.uk wi enough detail for us tae reproduce it. We wull acknowledge yer report, normally within three warkin days, an keep ye informed. Gin ye wish, we wull credit ye yince the maitter is resolved.
We will no tak legal action agin guid-faith security resairch that respects user privacy, avoids service disruption an gies us reasonable time tae fix issues afore public disclosure. Oor machine-readable policy is publisht at /.well-known/security.txt.
Service an support
Support comes frae the ingineers wha big oor seestems. The Service and SLA page describes severity defineetions, response expectations an maintenance windaes, an specific uptime an response targets is agreed in the contrack.
Severity definitions an the support model are set oot on the Service & SLA page. The exit & portability page describes the exit process. Live service status: the status board on uptime.systems.
Policíes
- Information Security Policy Publish'd
- Data Protection an Confidentiality Policy Publish'd
- Policy fur Siccar Software Development Publish'd
- Modren Sclavery Statement Publish'd
- Anti-Bribery & Fraud Policy Publish'd
- Equality & Diversity Policy Publish'd
- Environs Policy Publish'd
- Whistleblowin / Speak-Up Policy Publish'd
- Policie o Conflicts o Interest Publish'd
- Business Continuity Policy Publish'd
- Halth an Sauftie Policy Publish'd
- Quality Assurance Policy Publish'd
- Carbon Reduction Plan Publish'd
The policy register wi review dates
Concerns aboot wrang-daein can be raised confidentially throu oor Speak-Up portal, unner the Whistleblowing / Speak-Up Policy.
Mair
- Company information: Companies House details, procurement identifiers, insurance
- Security whitepaper: access control, encryption, secure development, incident response
- Data processing: roles, sub-processors, transfers, retention, breach handling
- Service & SLA: support model, severity definitions, maintenance windows
- Exit & portability: staunart export formats, migration support, deletion certificate
- Social value & carbon reduction: proportionate commitments an oor Carbon Reduction Plan
- Accessibility statement: oor WCAG 2.2 AA commitment an current status
- Privacy Policy: how we handle personal data (UK GDPR / DPA 2018)
- Terms o Service: staunart wabsteid terms