Your data is protected.
How we protect your data
Secure authentication
Access is restricted to authorised users. Authentication controls are documented for each product.
Data isolation
Product-appropriate access controls separate customer information and limit who can reach it.
Data minimisation
We limit data used for each workflow and use masking where appropriate; it is not a guarantee that all identifiers are removed.
UK GDPR principles
Built around UK GDPR principles: lawful basis, data minimisation, purpose limitation, and robust technical safeguards.
Document handling by design
Text, document and image workflows require different safeguards. Consult the product's privacy and security documentation for handling, exceptions and deletion periods.
ICO registered
CaseFlow Automation Ltd is registered with the UK Information Commissioner's Office (Registration: ZC013423). We design our services around UK GDPR principles including data minimisation and purpose limitation.
Our Cyber Essentials certification
CaseFlow Automation holds Cyber Essentials certification covering the whole organisation.
- Organisation certified
- CaseFlow Automation, 7-9 Macon Court, Crewe CW1 6EA
- Scope
- Whole organisation
- Certificate number
- 176bba48-8fb4-4f1a-a685-32d86b40fe3f
- Profile version
- 3.3 (Danzell)
- Date of certification
- 7 August 2026
- Recertification due
- 7 August 2027
- Certification body
- IT Cyber Solutions
- Accreditation partner
- IASME, the National Cyber Security Centre's delivery partner for the scheme
The certificate covers the organisation's assessed ICT controls, not a separate certification of each software product. Check the registry for its current status.
What Cyber Essentials actually covers
Cyber Essentials is a UK Government backed scheme delivered by IASME on behalf of the National Cyber Security Centre. It assesses an organisation against five technical controls.
Firewalls
Boundary and device firewalls are configured to block unapproved inbound traffic by default, with any exception documented and justified.
Secure configuration
Devices and software ship with convenient defaults rather than safe ones. This control covers removing what is not needed, changing default credentials and hardening what remains.
Security update management
Software is supported, licensed and patched. High risk and critical updates are applied within defined timescales, and unsupported software is removed.
User access control
Accounts are issued to named individuals, access is granted on need, administrative privileges are separated from day to day accounts, and access is removed when someone leaves.
Malware protection
Devices are protected against malicious code through anti-malware software, application allow listing, or sandboxing.
What Cyber Essentials does not cover
We would rather be straight with you about the limits of this than let a badge do work it cannot do.
Cyber Essentials is a verified baseline, not an exhaustive audit. It confirms that the five controls above were in place at the point of assessment. It is not the same as Cyber Essentials Plus, which adds a hands on technical audit, and it is not ISO 27001, which certifies a whole information security management system.
The certificate itself carries this wording, and we think it is worth repeating rather than burying: the certificate confirms the organisation's ICT defences were assessed as satisfactory against commodity based cyber attacks at the time of testing, and does not guarantee those defences will remain satisfactory against a cyber attack.
Security is a practice, not a certificate. The certificate is evidence that we take the practice seriously enough to be assessed on it every year.
Verifying this certificate yourself
Do not take a badge on a website as proof of anything. Anyone can put an image in a footer.
Every Cyber Essentials certificate is recorded on an independent registry. Ours is published at the link below, and the registry entry will show as active while the certification is current and lapse if it is not renewed.
Check our certificate on the official registry: https://registry.blockmarktech.com/certificates/176bba48-8fb4-4f1a-a685-32d86b40fe3f/active/
Role-based access control
Access is limited according to the needs of each product and role. Product-specific permissions are documented separately.
- Role-appropriate permissions
- Restricted case access
- Access review
Security features
- Encrypted data at rest and in transit
- Access controls appropriate to the product
- Data minimisation and workflow-specific masking
- Customer content is not used to train AI models
- Product-specific security documentation
- Review and traceability appropriate to the workflow
Working with regulated clients
If you are running a procurement or supplier assurance process, we are used to it and we will not make it difficult. Alongside this certification we can provide a data processing agreement, answer a security questionnaire, and talk through where data is held and who can reach it.
For anything not answered here, contact us and ask. A question we cannot answer straight is a question worth us fixing.