Trust Centre
Security, privacy and compliance
For buyers an security reviewers assessin RODMENA as a supplier, this page shaws the praisent status aside the claims we mak.
Public-sector buyin
Appointit RODMENA is an appointed supplier on the Government Commercial Agency’s Artificial Intelligence Dynamic Purchasing System (RM6200). UK public-sector buyers can invite us to their competitions under the agreement and award contracts through it.
- Agreement
- Artificial Intelligence Dynamic Purchasing System (RM6200)
- Contractin authority
- Government Commercial Agency
- Oor status
- Appointed supplier
- Appointed
- 7 October 2026
- Agreement rins until
- 23 February 2029
- Agreement page
- RM6200 on the Government Commercial Agency wabsteid
The greement page descrives the seestem but daesna leet suppliers. Buyers see the appyntit suppliers whan they filter the seestem in their ain accoont.
Ither Government Commercial Agency agreements
We are forby an appointit supplier on thir agreements. UK public-sector buyers can invite us tae competitions run unner thaim and gie oot contracts throu thaim.
| Agreement | Appointed | Agreement rins until | Agreement page |
|---|---|---|---|
| Spark Dynamic Purchasing System (RM6094) | 12 October 2026 | 15 February 2029 | RM6094 on the Government Commercial Agency wabsteid |
| Quality Assurance and Testing for IT Systems 2 Dynamic Purchasing System (RM6148) | 12 October 2026 | 23 February 2029 | RM6148 on the Government Commercial Agency wabsteid |
| Automation Marketplace Dynamic Purchasing System (RM6173) | 12 October 2026 | 15 November 2026 | RM6173 on the Government Commercial Agency wabsteid |
| Low Value Purchase System (RM6237) | 22 September 2026 | 31 March 2027 | RM6237 on the Government Commercial Agency wabsteid |
Supplier marketplaces
RODMENA is an Approved Supplier on the Constellia Marketplace. Constellia runs procurement for public and private sector organisations, and its clients buy through the suppliers it has approved.
- Marketplace
- Constellia Marketplace
- Run by
- Constellia Public Ltd, London
- Oor status
- Approved Supplier
- Approved
- 19 October 2026
- Evidence
- Constellia’s written confirmation, sent tae buyers on request. www.constellia.com
Security oweriew
RODMENA is a UK saftware company that bigs fault-tolerant seestems. Traffic tae aw wir services is encrypted in transit, an fowk gets anerly the access their wark needs. We rin an harden wir ain infrastructur. Wir development practice is designed tae haud in failures an recover frae them. Forby business correspondence we haud wee personal data, an this wabsteid uses nae analytics, trackers or advertising cookies.
Access control, encryption, secure development, backups, vulnerability management and incident response are covered in detail in our security whitepaper.
Security contact: security@rodmena.co.uk (see forby responsible disclosure and security.txt).
Text messages frae RODMENA
Text messages frae RODMENA’s platforms, includin RODMENA ID an Futex, are sent anerly frae +44 7822 000922, a nummer we uise for naething else. Gin a text claimin tae be frae RODMENA comes frae onie ither nummer, it isna oors. Please report it tae security@rodmena.co.uk. Tae rax us bi phone or text, uise +44 7537 179434.
Certifications and compliance
| Certification or assessment | Status | Issued | Expires | Evidence |
|---|---|---|---|---|
| Cyber Essentials Certifee'd by GDAK (G-DAK Cyber Solution Ltd); Cyber Essentials Partner IASME (UK Government-backit scheme). Certificate 00d24b59-7739-4d97-bb66-341ac50ef018. Scope: hale organisation. Profile 3.3 (Danzell) | Certifee'd | 2026-09-30 | 2027-09-30 | Register entry |
| Cyber Essentials Plus IASME (UK NCSC scheme). Planned tae follae Cyber Essentials | Planned | — | — | — |
| ICO Data Protection Registration Information Commissioner's Office. Registration reference ZC202334 (Tier 1); verifie on the public ICO register | Registert | 2026-07-19 | 2027-07-18 | Register entry Certificate (PDF) |
| NHS Data Security and Protection Toolkit (DSPT) NHS England. 2026-27 (version 9) assessment, organisation code (ODS) T6S8P | Staundarts met | 2026-10-22 | 2028-06-30 | Register entry Certificate (PDF) |
| ISO/IEC 27001 (Information Security) UKAS-accredited certification body. On the roadmap as the company grows | Planned | — | — | — |
| Penetration testing Independent security tester. A summary o scope and findins will be furthset efter the first penetration test | Planned | — | — | — |
Cyber Essentials
RODMENA LIMITED is certified unner the UK Government-backed Cyber Essentials scheme for the hale organisation.
- Certificate
- 00d24b59-7739-4d97-bb66-341ac50ef018
- Scope
- Hale organisation
- Profile
- 3.3 (Danzell)
- Certifee'd
- 30 September 2026
- Recertification due
- 30 September 2027
- Certification body
- GDAK (G-DAK Cyber Solution Ltd), wi IASME as the Cyber Essentials Partner
- Cyber insurance
- Cyber insurance in place. Evidence available on request from security@rodmena.co.uk.
- Verification
- Public certificate record on the BlockMark registry
The certificate confirms that, when assessed, our ICT defences met the Cyber Essentials requirements against commodity cyber attacks. It is not a guarantee that they will remain satisfactory against every attack.
Insurance
Cyber insurance in place. Evidence available on request from security@rodmena.co.uk. The policy comes wi oor Cyber Essentials certificate and rins for the same period. Subject tae its terms and limit, it pays for incident response, the costs o haundlin a cyber incident (legal advice, IT forensics, data recovery, notifeein fowk that's affectit and public relations), loss o income while oor systems are interruptit, data protection investigations and fines (whaur the law permits), and claims fae third pairties efter a data breach or security failure. It disna cover money stown throu cyber-crime or invoice fraud, and it isna professional indemnity or public liability cover.
Professional indemnity, public liability and employer’s liability cover is in place unner ae policy wi CFC Underwriting, for Lloyd’s syndicates. The cover is pit in place tae the leemits a contract requires and evidenced afore signature.
| Cover | Status | Details |
|---|---|---|
| Professional indemnity | In place | CFC Underwriting, for Lloyd’s syndicates, £1,000,000 each and every claim. The cover rins frae 1 November 2026 tae 1 November 2027. |
| Public liability | In place | CFC Underwriting, for Lloyd’s syndicates, £5,000,000 each and every claim. The cover rins frae 1 November 2026 tae 1 November 2027. |
| Employer’s liability | In place | CFC Underwriting, for Lloyd’s syndicates, £10,000,000 each and every claim. The cover rins frae 1 November 2026 tae 1 November 2027. |
| Cyber | In place | Rins tae 30 September 2027 alangside the certificate. Insurer an leemit on request. |
Privacy an data protection
We haud minimal personal data, leemitit tae business correspondence. This wabsteid sets nae cookies an rins nae analytics or trackers. Oor Privacy Policy descrives hou we process personal data. The Article 28 terms we offer are on the Data Processing Agreement page.
DPA requests: legal@rodmena.co.uk · privacy and data-protection questions: privacy@rodmena.co.uk · data-subject requests: gdpr@rodmena.co.uk.
Sub-processors
| Provider | Pupose | Whaur data is prucessed |
|---|---|---|
| OVHcloud | Virtual servers for the production database tier and some application services, and object storage for encrypted backups | Unitit Kinrick, France and Germany |
| iDNet | Virtual servers for the wabsteid and application services, and the office connection | Unitit Kinrick |
| Cloud Nord | Servers for a build runner, alertin an the partner portal | Unitit Kinrick |
| Google Workspace | Staff email, calendars and documents, includin correspondence wi customers | Ireland, Unitit States and ither Google locations |
| Anthropic | Claude Enterprise, the AI assistant RODMENA engineers uise tae operate its systems, that can see operational logs and data | Unitit States |
| GitHub | Hostin o source code an continuous integration | Unitit States |
The full register, wi ilka contracting company, the transfer safeguards and the chynges syne 5 October 2026, is on the data processing page. Chynges are annoonced at least 30 days ahead in the sub-processor feed.
External services that process nae personal data
RODMENA cmi5 airtins its audit chain wi a public RFC 3161 timestamp authority. That service gets a SHA-256 digest o a signed chain heid, aboot ilka fifteen meenits, and only for a customer whase chain has chynged. Nae personal data, nae identifiers and nae learning records are sent tae it. Whan it canna be reached, learning, launches, statements and evidence export are no affected, and anchoring retries on the next pass.
Prism, the model gateway o RODMENA, sends requests tae InferX Technologies, Inc. (Unitit States) for language-model inference. Nae customer personal data is sent tae it. Afore Prism is uised wi customer personal data, the model will be hostit in the Unitit Kinrick or providit unner a contract wi transfer safeguards.
Oor domain registrar an DNS provider hauds only domain an zone records.
Responsible disclosure
Gin ye think ye hae fund a security vulnerability in this wabsteid or in a RODMENA product, please email security@rodmena.co.uk wi eneuch detail for us tae reproduce it. We will acknowledge yer report, normally within three wirkin days, and keep ye informed. Gin ye wish, we will credit ye aince the maiter is resolved.
We will no tak legal action agin guid-faith security resairch that respects user privacy, avoids service disruption and gies us reasonable time tae fix issues afore public disclosure. Our machine-readable policy is published at /.well-known/security.txt.
Service and support
Support comes frae the ingineers wha big wir seestems. The Service and SLA page descrives severity definitions, response expectations an maintenance windows, an specific uptime an response targets are greed in the contract.
Severity definitions and the support model are set out on the Service & SLA page. The exit & portability page describes the exit process. Live service status: the status board on uptime.systems.
Policíes
- Information Security Policy Publishit
- Data Protection an Confidentiality Policy Publishit
- Policy for Siccar Software Development Publishit
- Modren Sclavery Statement Publishit
- Anti-Bribery & Fraud Policy Publishit
- Equality & Diversity Policy Publishit
- Environment Policy Publishit
- Whistleblowing / Speak-Up Policy Publishit
- Policie on Conflicts o Interest Publishit
- Business Continuity Policy Publishit
- Health and Safety Policy Publishit
- Quality Assurance Policy Publishit
- Plan fur Cuttin Carbon Publishit
The policy register wi review dates
Concerns aboot wrongdoing can be raised confidentially throu oor Speak-Up portal, under the Whistleblowing / Speak-Up Policy.
Mair
- Company information: Companies House details, procurement identifiers, insurance
- Security whitepaper: access control, encryption, secure development, incident response
- Data processing: roles, sub-processors, transfers, retention, breach handling
- Service & SLA: support model, severity definitions, maintenance windaes
- Exit & portability: staundart export formats, migration support, deletion certificate
- Social value & carbon reduction: proportionate commitments and oor Carbon Reduction Plan
- Accessibility statement: oor WCAG 2.2 AA commitment and current status
- Privacy Policy: hou we haundle personal data (UK GDPR / DPA 2018)
- Terms o Service: staundart wabsteid terms