Trust Centre
Security, privacy and compliance
For buyers and security reviewers assessing RODMENA as a supplier, this page shows the current status next to the claims we make.
Public-sector buying
Appointed RODMENA is an appointed supplier on the Government Commercial Agency’s Artificial Intelligence Dynamic Purchasing System (RM6200). UK public-sector buyers can invite us to their competitions under the agreement and award contracts through it.
- Agreement
- Artificial Intelligence Dynamic Purchasing System (RM6200)
- Contracting authority
- Government Commercial Agency
- Our status
- Appointed supplier
- Appointed
- 7 October 2026
- Agreement runs until
- 23 February 2029
- Agreement page
- RM6200 on the Government Commercial Agency website
The agreement page describes the system but does not list suppliers. Buyers see the appointed suppliers when they filter the system in their own account.
Other Government Commercial Agency agreements
We are also an appointed supplier on these agreements. UK public-sector buyers can invite us to competitions run under them and award contracts through them.
| Agreement | Appointed | Agreement runs until | Agreement page |
|---|---|---|---|
| Spark Dynamic Purchasing System (RM6094) | 12 October 2026 | 15 February 2029 | RM6094 on the Government Commercial Agency website |
| Quality Assurance and Testing for IT Systems 2 Dynamic Purchasing System (RM6148) | 12 October 2026 | 23 February 2029 | RM6148 on the Government Commercial Agency website |
| Automation Marketplace Dynamic Purchasing System (RM6173) | 12 October 2026 | 15 November 2026 | RM6173 on the Government Commercial Agency website |
| Low Value Purchase System (RM6237) | 22 September 2026 | 31 March 2027 | RM6237 on the Government Commercial Agency website |
Supplier marketplaces
RODMENA is an Approved Supplier on the Constellia Marketplace. Constellia runs procurement for public and private sector organisations, and its clients buy through the suppliers it has approved.
- Marketplace
- Constellia Marketplace
- Run by
- Constellia Public Ltd, London
- Our status
- Approved Supplier
- Approved
- 19 October 2026
- Evidence
- Constellia’s written confirmation, sent to buyers on request. www.constellia.com
Security overview
RODMENA is a UK software company that builds fault-tolerant systems. Traffic to all our services is encrypted in transit, and people get only the access their work needs. We run and harden our own infrastructure. Our development practice is designed to contain failures and recover from them. Apart from business correspondence we hold little personal data, and this website uses no analytics, trackers or advertising cookies.
Access control, encryption, secure development, backups, vulnerability management and incident response are covered in detail in our security whitepaper.
Security contact: security@rodmena.co.uk (see also responsible disclosure and security.txt).
Text messages from RODMENA
Text messages from RODMENA’s platforms, including RODMENA ID and Futex, are sent only from +44 7822 000922, a number we use for nothing else. If a text claiming to be from RODMENA comes from any other number, it is not ours. Please report it to security@rodmena.co.uk. To reach us by phone or text, use +44 7537 179434.
Certifications and compliance
| Certification or assessment | Status | Issued | Expires | Evidence |
|---|---|---|---|---|
| Cyber Essentials Certified by GDAK (G-DAK Cyber Solution Ltd); Cyber Essentials Partner IASME (UK Government-backed scheme). Certificate 00d24b59-7739-4d97-bb66-341ac50ef018. Scope: whole organisation. Profile 3.3 (Danzell) | Certified | 2026-09-30 | 2027-09-30 | Register entry |
| Cyber Essentials Plus IASME (UK NCSC scheme). Planned to follow Cyber Essentials | Planned | — | — | — |
| ICO Data Protection Registration Information Commissioner's Office. Registration reference ZC202334 (Tier 1); verify on the public ICO register | Registered | 2026-07-19 | 2027-07-18 | Register entry Certificate (PDF) |
| NHS Data Security and Protection Toolkit (DSPT) NHS England. 2026-27 (version 9) assessment, organisation code (ODS) T6S8P | Standards met | 2026-10-22 | 2028-06-30 | Register entry Certificate (PDF) |
| ISO/IEC 27001 (Information Security) UKAS-accredited certification body. On the roadmap as the company grows | Planned | — | — | — |
| Penetration testing Independent security tester. A summary of scope and findings will be published after the first penetration test | Planned | — | — | — |
Cyber Essentials
RODMENA LIMITED is certified under the UK Government-backed Cyber Essentials scheme for the whole organisation.
- Certificate
- 00d24b59-7739-4d97-bb66-341ac50ef018
- Scope
- Whole organisation
- Profile
- 3.3 (Danzell)
- Certified
- 30 September 2026
- Recertification due
- 30 September 2027
- Certification body
- GDAK (G-DAK Cyber Solution Ltd), with IASME as the Cyber Essentials Partner
- Cyber insurance
- Cyber insurance in place. Evidence available on request from security@rodmena.co.uk.
- Verification
- Public certificate record on the BlockMark registry
The certificate confirms that, when assessed, our ICT defences met the Cyber Essentials requirements against commodity cyber attacks. It is not a guarantee that they will remain satisfactory against every attack.
Insurance
Cyber insurance in place. Evidence available on request from security@rodmena.co.uk. The policy comes with our Cyber Essentials certificate and runs for the same period. Subject to its terms and limit, it pays for incident response, the costs of handling a cyber incident (legal advice, IT forensics, data recovery, notifying affected people and public relations), loss of income while our systems are interrupted, data protection investigations and fines (where the law permits), and claims from third parties after a data breach or security failure. It does not cover money stolen through cyber-crime or invoice fraud, and it is not professional indemnity or public liability cover.
Professional indemnity, public liability and employer’s liability cover is in place under one policy with CFC Underwriting, for Lloyd’s syndicates. Cover is placed to the limits a contract requires and evidenced before signature.
| Cover | Status | Details |
|---|---|---|
| Professional indemnity | In place | CFC Underwriting, for Lloyd’s syndicates, £1,000,000 each and every claim. Cover runs from 1 November 2026 to 1 November 2027. |
| Public liability | In place | CFC Underwriting, for Lloyd’s syndicates, £5,000,000 each and every claim. Cover runs from 1 November 2026 to 1 November 2027. |
| Employer’s liability | In place | CFC Underwriting, for Lloyd’s syndicates, £10,000,000 each and every claim. Cover runs from 1 November 2026 to 1 November 2027. |
| Cyber | In place | Runs to 30 September 2027 alongside the certificate. Insurer and limit on request. |
Privacy and data protection
We hold minimal personal data, limited to business correspondence. This website sets no cookies and runs no analytics or trackers. Our Privacy Policy describes how we process personal data. The Article 28 terms we offer are on the Data Processing Agreement page.
DPA requests: legal@rodmena.co.uk · privacy and data-protection questions: privacy@rodmena.co.uk · data-subject requests: gdpr@rodmena.co.uk.
Sub-processors
| Provider | Purpose | Where data is processed |
|---|---|---|
| OVHcloud | Virtual servers for the production database tier and some application services, and object storage for encrypted backups | United Kingdom, France and Germany |
| iDNet | Virtual servers for the website and application services, and the office connection | United Kingdom |
| Cloud Nord | Servers for a build runner, alerting and the partner portal | United Kingdom |
| Google Workspace | Staff email, calendars and documents, including correspondence with customers | Ireland, United States and other Google locations |
| Anthropic | Claude Enterprise, the AI assistant RODMENA engineers use to operate its systems, which can see operational logs and data | United States |
| GitHub | Source code hosting and continuous integration | United States |
The full register, with each contracting company, the transfer safeguards and the changes since 5 October 2026, is on the data processing page. Changes are announced at least 30 days ahead in the sub-processor feed.
External services that process no personal data
RODMENA cmi5 anchors its audit chain with a public RFC 3161 timestamp authority. That service receives a SHA-256 digest of a signed chain head, about every fifteen minutes, and only for a customer whose chain has changed. No personal data, no identifiers and no learning records are sent to it. When it cannot be reached, learning, launches, statements and evidence export are unaffected, and anchoring retries on the next pass.
Prism, RODMENA’s model gateway, sends requests to InferX Technologies, Inc. (United States) for language-model inference. No customer personal data is sent to it. Before Prism is used with customer personal data, the model will be hosted in the United Kingdom or provided under a contract with transfer safeguards.
Our domain registrar and DNS provider holds only domain and zone records.
Responsible disclosure
If you think you have found a security vulnerability in this website or in a RODMENA product, please email security@rodmena.co.uk with enough detail for us to reproduce it. We will acknowledge your report, normally within three working days, and keep you informed. If you wish, we will credit you once the issue is resolved.
We will not take legal action against good-faith security research that respects user privacy, avoids service disruption and gives us reasonable time to fix issues before public disclosure. Our machine-readable policy is published at /.well-known/security.txt.
Service and support
Support comes from the engineers who build our systems. The Service and SLA page describes severity definitions, response expectations and maintenance windows, and specific uptime and response targets are agreed in the contract.
Severity definitions and the support model are set out on the Service & SLA page. The exit & portability page describes the exit process. Live service status: the status board on uptime.systems.
Policies
- Information Security Policy Published
- Data Protection and Confidentiality Policy Published
- Secure Software Development Policy Published
- Modern Slavery Statement Published
- Anti-Bribery & Fraud Policy Published
- Equality & Diversity Policy Published
- Environmental Policy Published
- Whistleblowing / Speak-Up Policy Published
- Conflicts of Interest Policy Published
- Business Continuity Policy Published
- Health and Safety Policy Published
- Quality Assurance Policy Published
- Carbon Reduction Plan Published
The policy register with review dates
Concerns about wrongdoing can be raised confidentially through our Speak-Up portal, under the Whistleblowing / Speak-Up Policy.
More
- Company information: Companies House details, procurement identifiers, insurance
- Security whitepaper: access control, encryption, secure development, incident response
- Data processing: roles, sub-processors, transfers, retention, breach handling
- Service & SLA: support model, severity definitions, maintenance windows
- Exit & portability: standard export formats, migration support, deletion certificate
- Social value & carbon reduction: proportionate commitments and our Carbon Reduction Plan
- Accessibility statement: our WCAG 2.2 AA commitment and current status
- Privacy Policy: how we handle personal data (UK GDPR / DPA 2018)
- Terms of Service: standard website terms