Security & compliance
Privacy-first design
Fertility data includes health data, considered a special category of personal data under Article 9 of the GDPR. Isolation, credential management and data residency are part of the platform's design.
Controls
Measures applied in the platform
Isolation by organisation
Each clinic is a separate organisation, with isolation enforced in the database. A clinic can read and write only its own data.
Protected credentials
Connection credentials are stored encrypted and are never returned to the interface. The cockpit shows only which credentials are set, never their values.
Local agent at the clinic
For systems installed at the clinic, such as VRepro, an agent runs inside the clinic and executes the operations locally. The clinic opens no inbound access, and patient data and credentials stay there.
Personal data kept out of the cockpit
Raw records are held in a store the interface cannot read. Monitoring runs on a separate event log without personal data.
Audit log
Security-relevant actions, such as setting a credential, changing a connection or activating a workflow, are recorded in a log that cannot be altered.
Retention and erasure
Raw data is deleted on a schedule, in support of the storage-limitation and erasure obligations of the GDPR.
Data residency
EU data, kept in the EU.
For EU clinics, data and credentials are hosted on EU infrastructure, with a documented data processing agreement and subprocessor list, established before any real patient data is onboarded.
Compliance
Certifications in progress
The processes implemented by Nidus are compatible with the certifications that groups in the sector and their security teams require. The controls described above are the basis of those certifications.
ISO 27001
Information security management
The ISMS backbone: policies, risk register, access reviews and vendor management.
ISO 27701
Privacy information management
Privacy controls and data governance for special-category health data.
SOC 2 Type II
Trust services criteria
Continuous evidence of security, availability and confidentiality controls over time.
ISO 27001, ISO 27701 and SOC 2 Type II are in progress. The controls described on this page are implemented in the platform today. Current documentation is available on request.
See Nidus in operation
Book a full demo of the platform: the data model, the cockpit, the workflows and the integration process.