CERTIFICATIONS · CURRENT AND INDEPENDENTLY VERIFIABLE
The certificates, in full.
Certificate numbers, scope wording, issuing bodies and expiry dates, so you can check every claim on this site against the certification body’s own register rather than taking our word for it.
INFORMATION SECURITY
ISO/IEC 27001:2022
Certified since 2019 and transitioned to the 2022 revision of the standard. The scope covers the design and supply of online software automation services, incorporating the requirements of ISO/IEC 27017:2015 for cloud security and ISO/IEC 27018:2014 for protection of personal data in the cloud.
CYBER SECURITY
Cyber Essentials Plus
The audited tier of the UK government scheme, where an assessor independently tests the controls rather than accepting a self-assessment. Scope is the whole organisation, not a subset.
CLINICAL AND AI ASSURANCE
Medical device and AI management.
UKCA · Class I Medical Device
Spectral, the AI engine inside Toca Health, is UKCA-marked as a Class I medical device. Registered with the MHRA.
ISO 42001
AI management systems. Among the first teams in the UK to be certified.
DSPT
NHS Data Security and Protection Toolkit, completed annually.
DTAC
Digital Technology Assessment Criteria, completed for NHS deployment.
THE DOCUMENTS THEMSELVES
Certificates on request.
We don’t publish the certificate PDFs here. Hosted copies go stale, and a document we host ourselves is weaker evidence than one you verify at source, which is why the registers are linked above. For a procurement pack, a DPIA or a DTAC submission, ask and we will send the current certificates, the scope statements and the supporting evidence the same working day.