Security
Built for organisations that have to justify their choices.
If you work in the public sector, the software you buy has to survive scrutiny you did not choose and cannot avoid. This page is what we would want to read if we were on your side of the table.
UK engineered, UK hosted
We engineer in the United Kingdom and host in the United Kingdom by default. For organisations whose data requirements do not permit shared infrastructure, fully sovereign self-hosted deployment is available through our sister company CHMS Cyber Security.
Sensitive and special-category data
We build SEND software used across 70 local authorities. That involves special-category personal data about children and young people, handled under public-sector expectations for security, retention, access control and audit.
Accessibility as a foundation
We engineer to WCAG 2.1 AA, the standard commonly required in UK public-sector procurement. Accessibility is designed into the build rather than retrofitted before an audit, and our own colour system is contrast-tested rather than assumed.
Security expertise inside the group
CHMS Cyber Security is our sister company. Revelion, our autonomous AI penetration-testing platform, was built in-house. Security is not a discipline we buy in when a client asks about it.
Independence on assurance
We only carry out AI Assurance Audits on systems we did not build. Assurance depends on independence, and a supplier that reviews its own work is not providing any. We would rather decline the work than compromise the finding.
Reporting a vulnerability
If you believe you have found a security issue in anything we run, we publish a security.txt under RFC 9116 and we would rather hear from you than not.
FAQ
Common questions
Is DIGI software UK-hosted?
Yes. DIGI engineers and hosts in the United Kingdom by default, and sovereign self-hosted deployment is available through CHMS Cyber Security where data requirements demand it.
Do you have experience with sensitive personal data?
Yes. DIGI builds SEND software for UK local authorities, which involves special-category personal data about children and young people, handled under public-sector expectations for security, retention and access control.
Does DIGI software meet accessibility requirements?
DIGI engineers to WCAG 2.1 AA, which is the standard commonly required in UK public-sector procurement. Accessibility is treated as a foundation of the build rather than a later phase.
Need this in a procurement response?
We are used to supplying security, accessibility and data-handling detail in the format a framework or tender requires. Ask and we will send it.