Security
Forumly's CRM and database systems are designed with UK data protection and healthcare information-security requirements in mind. This page outlines the security practices Forumly applies to the systems it builds and manages.
How Forumly's systems are built
HTTPS / TLS
Traffic between users and Forumly's systems is encrypted in transit.
Secure Authentication
Passwords are stored using industry-standard hashing, never in plain text.
Role-Based Access
Access is controlled by role, so staff, doctors and patients see only what is relevant to them.
Least Privilege
Accounts are granted the minimum access required to perform their role.
CSRF Protection
Forms are protected against cross-site request forgery using per-session tokens.
Input Validation
All data is validated and sanitised on the server, regardless of any client-side checks.
Secure Sessions
Sessions use secure, HTTP-only cookies with regular regeneration.
Audit Logging
Key administrative actions are recorded in an audit log.
Private Document Storage
Documents are not stored in publicly accessible locations, and access is checked before any file is served.
Database Security
Databases are accessed exclusively through parameterised queries to prevent injection.
Backups
Backup approaches are planned according to how critical a client's data is.
Recovery Planning
Recovery steps are planned in advance rather than worked out after an incident.
Retention, deletion and incident response
Data retention and deletion approaches are agreed with each client according to their own requirements. Forumly plans an incident response approach for the systems it manages, so that any issue can be identified and addressed as quickly as possible.
Designed with UK data protection requirements in mind
Forumly's systems are designed with awareness of UK GDPR and the Data Protection Act 2018, including the additional care required for special-category data such as health information. This includes attention to confidentiality, access control, data minimisation, purpose limitation, data retention and privacy by design.
UK GDPR & DPA 2018
Systems are designed with these frameworks in mind throughout development.
Special-Category Data
Health and other special-category data is treated with additional care.
Data Minimisation
Systems are designed to capture the data actually required, not more.
Purpose Limitation
Data is structured around its intended use within the system.
Confidentiality & Access Control
Access to data is restricted according to role and need.
Privacy by Design
Privacy considerations are built into systems from the outset, not added afterwards.
Your organisation's own responsibilities
This page describes the security practices Forumly applies to the systems it builds and manages. It is not legal advice. Organisations remain responsible for determining their own legal and regulatory obligations, including under UK GDPR and the Data Protection Act 2018, and should seek independent legal advice where required. Forumly does not claim NHS approval, government approval or any specific compliance certification unless separately confirmed in writing.
Have security questions about your CRM?
Tell Forumly about your organisation's specific security or compliance requirements.
Request a CRM