In regulated industries, governance is not a compliance checkbox - it is the architecture decision that determines whether a system can be trusted with patient data, financial records, and operational continuity. We design for this from day one.
ISO 27001
Information Security Management System
ISO 9001
Quality Management System
SOC 2 Type II
Security, Availability & Confidentiality
HIPAA
Health Insurance Portability & Accountability
GDPR
General Data Protection Regulation
GAMP 5 & 21 CFR Part 11
Pharmaceutical & FDA compliance
Certifications are only meaningful when the underlying practices are real. Here is what each certification covers and what it means for your engagement with VARP.
Information Security Management
The international standard for information security management systems. Our ISO 27001 certification means every aspect of how we handle information - from client data and access controls to incident management and business continuity - is audited against a defined, documented standard. Not a policy on a shelf. An operating system.
Certified - Annually auditedQuality Management System
ISO 9001 governs the consistency and quality of our delivery processes - from how we scope and manage engagements to how we review, test, and hand over production systems. It is the certification that tells enterprise procurement teams that what was agreed in the contract will be what is delivered. Every project. Without variance.
Certified - Annually auditedSecurity, Availability & Confidentiality
SOC 2 Type II is the report enterprise security teams ask for before any significant data engagement. It independently verifies that our security controls - access management, encryption, monitoring, and incident response - have been operating effectively over a sustained period. Not a point-in-time snapshot. A continuous record.
Type II - Independent auditVARP operates in Healthcare, Financial Services, and Pharmaceutical - three sectors where non-compliance is not a reputational risk, it is an operational one. Our compliance posture is designed around the real regulatory requirements of each vertical.
Healthcare
The Health Insurance Portability and Accountability Act governs how Protected Health Information (PHI) is handled, stored, transmitted, and accessed. Every VARP system that touches clinical data - document extraction pipelines, RCM automation, patient workflows - is architected with HIPAA controls from day one: access logging, encryption, minimum necessary access, and Business Associate Agreements for every sub-processor.
Data protection
Our GDPR posture covers both VARP's own operations and the systems we build for clients in the EU and UK. Data processing agreements are standard on every engagement. Systems are designed with privacy by default - data minimisation, purpose limitation, and the right to erasure are architectural requirements, not retrofit fixes. Our DPO function ensures regulatory obligations are met across jurisdictions.
Pharmaceutical & Life sciences
GAMP 5 (Good Automated Manufacturing Practice) and 21 CFR Part 11 govern computer systems used in pharmaceutical manufacturing and clinical trials. 21 CFR Part 11 specifically requires electronic records and signatures to be trustworthy and reliable. VARP systems in this space are built with validated software development lifecycles, audit trails for every system action, and the documentation required to withstand an FDA inspection.
Financial services
For BFSI clients - including Checkout.com, Investec, and Jupiter - VARP engineers within the operational resilience and data handling requirements of UK financial regulation. Systems handling payment data, investment portfolios, and trading operations are built with the security controls, segregation of duties, and change management processes that financial services regulators require.
These are not policy statements. They are architectural commitments - built into how every system VARP delivers is designed, deployed, and operated.
Every client engagement uses isolated data environments. No client's data is processed, stored, or accessible in a context that includes another client's data. Isolation is enforced at the infrastructure level, not managed through access controls alone.
VARP will not use client data to fine-tune, evaluate, or improve any AI model - ours or a third party's - without explicit written authorisation. This applies to all LLM providers. Our standard contracts with AI vendors include zero-retention and no-training clauses for client data.
Where regulation or client policy requires data to remain within a specific jurisdiction - UK, EU, US - we architect accordingly. This includes model inference, intermediate storage, logging, and backup. We do not assume cloud regions are equivalent when data residency is mandated.
All client data is encrypted at rest (AES-256) and in transit (TLS 1.3 minimum). Encryption keys are managed per-client using dedicated KMS configurations. Key rotation schedules are defined at project inception and enforced programmatically.
Every VARP engineer working on a client engagement has access only to the data and systems required for their specific scope - and no more. Access is provisioned via role-based controls, time-bounded where appropriate, and reviewed at each project phase. Access to production environments requires explicit client approval and multi-factor authentication.
"If you're using Claude or OpenAI, what happens to our data?" The answer depends on what we're building and for whom. We operate a tiered deployment model - because a knowledge assistant for internal HR is a fundamentally different risk profile from an AI system processing clinical records.
Where data sensitivity permits, we use foundation model APIs (Claude, OpenAI GPT-4o, Gemini) under enterprise-grade Data Processing Agreements that include zero data retention, no training on submitted data, and data processed only in agreed regions. Suitable for internal knowledge assistants, workflow copilots, and document summarisation with non-PHI content.
For workloads involving PHI, financial data, or where regulation prohibits data leaving the client's environment - we deploy self-hosted, open-weight models (Llama 3, Mistral, domain-fine-tuned variants) on the client's own infrastructure. No data leaves the client's environment. No third-party API call. Full auditability.
Every cloud AI provider is contracted under terms that prohibit retention or use of submitted data beyond the scope of the immediate inference request.
RAG architectures ground every model response in retrievable source documents. This creates an auditable chain from output back to source - a requirement in regulated environments.
All AI interactions are logged with user identity, timestamp, and full input/output capture. Retained per client data policy. Available for regulatory audit.
Drift detection, accuracy monitoring, and anomaly alerts are standard on every production AI deployment. We do not assume models remain reliable without continuous measurement.
Any AI model involved in consequential decisions - approval routing, clinical triage, fraud flagging - is instrumented with bias monitoring and explainability requirements from deployment.
Security is built into our engineering process - not reviewed at the end of it. Our practices are aligned to the NIST Cybersecurity Framework and verified through our ISO 27001 audit cycle.
Security requirements are defined at the architecture phase. Threat modelling is conducted on all new systems. Code review includes security review gates before any merge to main.
Automated dependency scanning (Snyk, Dependabot) runs on every repository. Critical vulnerabilities are patched within 24 hours. Annual penetration testing by an independent third party.
All engineers use MFA-enforced SSO. Production access requires just-in-time provisioning and peer approval. Privileged access is time-bounded and fully logged.
All third-party dependencies are reviewed and approved before adoption. SBOMs (Software Bill of Materials) are maintained for all production systems and available to clients on request.
Zero-trust network architecture on all cloud deployments. Private endpoints, VPC isolation, and WAF protection are standard. No public database endpoints. Egress filtering enforced.
Security control architecture
Every production system will eventually experience an incident. The question is whether the response is coordinated or chaotic. Our incident response process is documented, rehearsed, and contractually committed to the timelines below.
Within 15 minutes
Automated monitoring detects anomaly. On-call engineer is paged. Severity is classified (P0-P3). Client primary contact is notified for P0 and P1 incidents.
Within 1 hour
Incident commander assigned. War room opened. Client stakeholders briefed. Preliminary impact assessment completed. Runbook activated where applicable.
Ongoing
Mitigation actions taken. Status updates issued every 30 minutes to client during active incident. All actions logged with timestamps. Rollback executed if safer than forward fix.
Within 48 hours
Root cause analysis delivered. Timeline of events documented. Corrective actions identified and assigned. Regulatory notification assessed (HIPAA 72hr, GDPR 72hr where applicable).
Data breach notification
Where an incident involves a personal data breach, VARP follows mandatory notification timelines: GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware. HIPAA requires notification of affected individuals within 60 days and HHS within 60 days of discovery. We will notify the client immediately upon confirmation of a breach and will assist with all required regulatory notifications.
These are not optional add-ons. Every VARP engagement includes the following contractual protections as standard - before a line of code is written.
Mutual non-disclosure agreement signed before any scoping conversation. Covers all technical, commercial, and business information exchanged in both directions. Perpetual confidentiality obligations on trade secrets.
A GDPR-compliant DPA is executed on every engagement where personal data is processed. Covers lawful basis, sub-processor disclosures, data subject rights obligations, and transfer mechanisms.
All intellectual property created in the course of a client engagement is assigned to the client upon final payment. VARP retains no licence to client-specific IP. Accelerators and pre-built components are licensed, not assigned, and disclosed upfront.
Enterprise clients have the right to audit VARP's security controls, data handling practices, and compliance posture. We will respond to security questionnaires and provide our ISO 27001 and SOC 2 reports to clients under NDA upon request.
Security enquiries
Most enterprise procurement processes include a security review - vendor questionnaires, penetration test reports, DPA negotiations, or a call with your CISO. We have answered these questions many times and will respond to any security enquiry seriously and promptly.
Security & compliance enquiries
ISO 27001 reports - SOC 2 reports - DPA requests - Vendor questionnaires
Responded to within 1 business day
Security incident reporting
Vulnerability disclosure - Suspected breach - Responsible disclosure
Acknowledged within 4 hours - 24/7
Available on request
Security documentation
ISO 27001 certificate - SOC 2 Type II report - Penetration test summary - SBOM - Standard DPA
If your security or procurement team needs documentation, a questionnaire response, or a call - we are ready. We have built systems at Checkout.com, Investec, Optum, and across regulated healthcare. We know what enterprise security review looks like.
