Certifications and standards
Independently assessed credentials that confirm our security, accessibility, and data protection posture.
ISO/IEC 27001:2022
ISO 27001 certified
Geeky Medics Ltd's information security management system, which covers SimChat, is certified to ISO/IEC 27001:2022, the international standard for information security management.
- Accredited certificationIndependently audited and certified by the British Assessment Bureau, a UKAS-accredited certification body.
- Audited every yearCertificate number 274184, valid to October 2029 and subject to annual surveillance audits.
GDPR
Fully compliant with the UK GDPR and Data Protection Act 2018. We act as a data processor under a Data Processing Agreement available to every customer.
Cyber Essentials
Geeky Medics Ltd holds Cyber Essentials certification, independently assessed by IASME against the UK Government's required cyber-security baseline.
Annual penetration testing
SimChat is penetration tested every year by an independent third-party security firm. Findings are tracked, prioritised, and remediated through our vulnerability management process.
WCAG 2.1 AA accessibility
Built to meet WCAG 2.1 Level AA: semantic HTML, keyboard navigation, screen-reader support, sufficient colour contrast, and visible focus states across the platform.
Procurement and due diligence
SimChat has successfully been through formal NHS procurement and full institutional security audits at universities and medical schools across the UK and internationally. We are familiar with the questionnaires, evidence packs, and information governance reviews these processes rely on.
Our security pack covers our ISO 27001 certificate, policy framework, penetration test summary, sub-processor list, data flow diagrams, and answers to common security questionnaires. Available on request under NDA.
Identity and access for institutional rollouts
Enterprise customers can plug SimChat into their existing identity stack, so account provisioning and deprovisioning follow the same controls as the rest of the IT estate.
SAML 2.0 and OIDC SSO
Tested with Okta, Microsoft Entra ID, Google Workspace, and PingFederate. Any standards-based identity provider is supported.
Just-in-time provisioning
Accounts are created on first successful login, and roles can be driven by attributes from your identity provider rather than managed by hand.
Role-based access and 2FA
Granular roles for administrators, authors, and learners, plus per-organisation enforcement options including required SSO and two-factor authentication.
LMS integration (LTI 1.3)
Launch learners directly from your LMS into a specific scenario, with the same just-in-time provisioning. Works with any LTI 1.3-compliant platform such as Canvas, Moodle, Blackboard, or Brightspace.
Security and governance programme
Documented policies and processes within our ISO 27001-certified management system, reviewed annually.
Information security
- ISO 27001-certified control framework
- Security policy and risk register
- Vulnerability scanning
- Patch and change management
- Incident response plan
Operational resilience
- Business continuity and DR plan
- Encrypted, geo-separate backups
- Secure software development lifecycle
- Vendor risk assessments
AI governance
- AI governance policy
- No customer data used for training
- Documented sub-processors
- Human oversight requirements
People and training
- Annual security awareness training
- HR security policy
- Acceptable use and remote access
- Background checks and NDAs