Evidence over assertion. Always.
careos is engineered so that every claim — security, safety, AI governance, compliance — is backed by machine-generated evidence. Not a paragraph in a policy document, not a diagram in a deck. Evidence you can export and verify.
Audit is not an afterthought. It is the ledger.
The Evidence Ledger is the append-only record of everything that happens inside careos. Human actions, AI decisions, access events, consent changes, break-glass sessions — committed, anchored, exportable.
Tamper-evident audit
Every action — human or AI — is committed to an append-only audit chain, cryptographically anchored and independently reviewable.
Automated evidence packs
DSAR, legal hold, access review and incident response generate evidence packs on demand — signed, scoped, timestamped, exportable.
Break-glass with visibility
Emergency access requires justification, opens a review item, carries an expiry, and is indistinguishable from any other audited action.
Retention as code
Retention schedules expressed as code: by data class, country pack and legal basis. Automated deletion with evidence of completion.
Exportable audit trail
Audit outputs are independently reviewable outside the application — cursor-paginated APIs, signed NDJSON exports and correlation IDs across systems.
SIEM integration
Forward audit, access and AI events to your SIEM of choice through signed webhooks and streaming exports, with schema-versioned payloads.
Boring fundamentals, done properly.
No clever tricks. Tenant isolation, authentication, encryption and incident discipline — engineered with the assumption that attackers are already inside.
Tenant isolation
Server-side scoped access on every path, with DB-level guardrails on high-risk tables. No client-trust, no row-level surprises.
Authentication everywhere
SSO, MFA, device trust, patient and proxy patterns, JIT elevation for sensitive actions. No long-lived privileged sessions.
Encryption by default
In-transit everywhere; at-rest for databases, files, backups and search indexes. Managed key rotation with audit.
Incident discipline
Severity model, audit preservation, communication templates and structured post-incident review baked into the platform.
Secrets management
Centralised secret store, rotation, access audit and zero secrets in source control or ungoverned CI variables.
Vendor governance
Every subprocessor, telephony provider, AI provider and storage partner tracked with contract status, DPA or BAA, review date and technical scope.
NHS-ready. Evidence-backed.
The UK profile ships with the clinical safety, procurement, identity, terminology and privacy packs required to deploy inside NHS environments.
Evidence objects, audit artefacts and hazard-log linkage that a deploying organisation's Clinical Safety Officer can use during their own clinical safety case work. CareOS Platform does not itself hold a clinical safety case.
DTAC and DSPT workflow support — structured questionnaires and evidence assembly the customer completes for their own submission.
NHS login adapter, NHS Notify adapter and NHS number patterns throughout the graph.
dm+d medication terminology and UK interoperability profiles.
GDPR and DPA 2018 workflows with health & care records retention schedules.
Endpoint discipline, access controls, vulnerability management and supply-chain practices designed in line with widely-recognised baselines.
Designed to HIPAA principles. Transparent AI. Payer-aware.
The US profile is engineered to HIPAA Security Rule principles, with US Core interoperability patterns, transparent AI review logs and prior-authorization workflow design.
Designed to HIPAA Security Rule principles — administrative, physical and technical safeguards engineered into the platform from day one. CareOS Platform is not itself a HIPAA-certified product; formal BAA work is on the roadmap.
US Core profile patterns, SMART on FHIR adapter patterns, FHIR bundle import/export. NPI provider identifier support.
Algorithm transparency, explainable AI outputs and full review/override logs across every clinically-influential decision.
Prior-authorization workflow design, evidence assembly and denial-prevention tasking.
RxNorm and NDC medication terminology coverage for US drug references.
CareOS Platform is an early-access product. Formal certifications (e.g. SOC 2, ISO 27001) are on the roadmap as we scale revenue and customer base. We are transparent with every buyer about current status.
SLOs we publish. Drills we run.
careos operates with explicit service level objectives, recovery targets and release safety practices. Feature flags, canary, rollback and post-deploy verification on every change.
Feature flags, canary deployments, automated rollback and post-deploy verification gates on every release — with evidence captured in the ledger.
Honest about where we are.
CareOS Platform is an early-access product from a UK startup. We are designing to the principles of ISO 27001, SOC 2 and HIPAA from day one — encryption at rest and in transit, role-based access, comprehensive audit logging, and the Evidence Ledger — but we do not yet hold formal certifications. Formal certification is on the roadmap as we scale.
For current status, technical detail and evidence samples, request access to the CareOS Platform trust centre.
Frequently asked.
We get the same two questions from every serious buyer. Here are the answers before you ask.
Are you certified?
Not yet. CareOS Platform is an early-access product from a UK startup. We are designing to the principles of ISO 27001, SOC 2 and HIPAA from day one — encryption at rest and in transit, role-based access, comprehensive audit logging, and the Evidence Ledger — but we do not yet hold formal certifications. Formal certification is planned as we scale revenue and customer base. We are transparent about this with every buyer.
What about NHS clinical safety (DCB0129 / DCB0160)?
DCB0129 and DCB0160 require a named Clinical Safety Officer on the deploying organisation’s side. CareOS Platform provides the evidence objects and audit artefacts your CSO needs; we do not ourselves hold a clinical safety case — that is a joint effort between platform and deploying customer.
Are you HIPAA compliant?
CareOS Platform is designed to HIPAA Security Rule principles — administrative, physical and technical safeguards engineered into the platform from day one. We do not yet have BAA work in place and we are not a HIPAA-certified product. Formal HIPAA readiness is on the roadmap. If your procurement requires a BAA today, talk to us about timing.
Request the trust centre.
Security overview, evidence pack samples, SLO reports, AI governance controls and country-pack details — shared under NDA with qualified evaluators.