Organisations ask about security before they ask about features, and that makes sense, because ePCR holds patient records. This note sets out what we have in place and who is responsible for what.
The company
SnapMedic Ltd (company number 17449168) is Cyber Essentials certified, as of 6 October 2026. The certification covers the whole organisation, and you can check it on the public registry. We say more in our Cyber Essentials announcement.
SnapMedic is also registered with the Information Commissioner's Office (registration ZC257109).
Where patient data lives
Patient data is hosted in the UK, in the London region of our hosting provider, Civo. Civo holds ISO/IEC 27001:2022 and Cyber Essentials Plus certification and a SOC 2 Type II report. The data centre operator, Kao Data, is ISO 27001 certified.
We keep encrypted backups separately with OVHcloud, also in its London region. OVHcloud's object storage is ISO 27001, 27017 and 27018 certified.
Those are our providers' certifications, not SnapMedic's own. We mention them because you're entitled to know who sits underneath the service, and because they matter when you do supplier checks.
Access controls in the product
Patient records belong to your organisation. They are stored server-side and readable by the service for authorised synchronisation, audit and support. Organisation isolation, named permissions, encryption and audit logging govern access.
Members sign in with a one-time email code, and identifiable recording also uses an authenticator. There is no public sign-up. If a tablet goes missing from a vehicle or a volunteer leaves, your administrator can revoke that device's session straight away, without waiting for us.
A colleague joins a record by exact incident reference or record ID. There is no browsable list or free-text patient search, and every lookup is audited.
A locked record keeps its original. Signed updates show who added what, and each entry keeps its author and time.
What we'd ask any ePCR supplier
We started as paramedics, so we know what a patient record is worth when it goes wrong. These are the questions we'd put to any supplier, ourselves included.
- Where is patient data stored, and in which country?
- Where do backups go, and are they encrypted?
- Who at the supplier can read a record, and is that access logged?
- What happens to my data if I leave?
The honest test of an answer is whether it names a place, a provider and a person. "Secure cloud hosting" names none of them. Ours are above, and we'll put the rest in writing for your service.
What this means for your due diligence
Cyber Essentials is a baseline. It shows an organisation has basic technical controls in place against common cyber attacks. It doesn't replace your own supplier checks, and records in an ePCR can help you evidence how your service handles patient information, but they don't make your service compliant with a standard by themselves.
For a supplier review, ask us for:
- The Cyber Essentials certificate details, so you can check them on the public registry.
- A written description of hosting and retention for your service.
- A list of who at SnapMedic can read patient data, and when.
Hosting and retention arrangements are agreed with each organisation, and the quote sets them out.
Questions
If your security or information governance team has questions, get in touch. For how the product works, read SnapMedic ePCR.
