Security
HexAI builds voice agents that phone patients for healthcare organisations. This page sets out the security controls built into the platform today, and where we are with each NHS assurance standard.
Last updated: 19 October 2026
Controls in the platform today
A separate environment for each organisation
Each organisation runs on its own application stack and its own database, so one organisation’s data is never stored alongside another’s.
Encrypted connections between services
In production, the platform’s services will not start unless their connections to the database, to each other and to the session store are encrypted.
Telephony credentials encrypted at rest
Phone-carrier credentials and SIP passwords that organisations give us are encrypted in the database with AES-256-GCM.
Role-based access for staff
Staff permissions are checked by role on every protected request. Passwords are stored as bcrypt hashes and sign-in sessions expire.
An audit trail, including who viewed a record
The platform records changes to data, and records when a member of staff opens an individual patient’s record.
Identifiers removed from logs
NHS numbers, phone numbers, email addresses and postcodes are replaced with placeholders before log lines are written, and sign-in headers are hidden.
No automated call without agreement
The scheduler only queues an automated AI call for a patient whose agreement to AI calls is on record. If a patient withdraws it, that applies straight away.
Data rights and retention
Staff can export everything held about a patient, or erase it. An automated purge removes each type of data once its retention period has passed.
Protected patient links
Links sent to patients expire, work once, lock after repeated wrong attempts and are rate-limited.
Assurance status
Where we are with each standard an NHS organisation will ask about. We will update this as each one progresses.
| Standard | What it covers | Status |
|---|---|---|
| Data protection impact assessment (DPIA) | How patient data is used, and the risks and safeguards. | Complete |
| DCB0129 clinical safety case | The NHS clinical safety standard for manufacturers of health IT. | In progress |
| DCB0160 hazard log | What we provide so deploying organisations can meet their own clinical safety duty. | In progress |
| DTAC | The NHS Digital Technology Assessment Criteria. | In progress |
| Data Security and Protection Toolkit (DSPT) | The NHS self-assessment for organisations with access to NHS patient data. | In progress |
| Cyber Essentials | The UK government-backed baseline security certification. | In progress |
| Penetration testing | Testing the platform’s defences as an attacker would. Our initial internal assessment is complete; independent testing will follow. | Initial assessment complete |
Who is responsible for what
The healthcare organisation that uses HexAI stays the data controller for its patients’ information. HexAI acts as its data processor and handles that data only on the organisation’s documented instructions. Where processing happens is set out on our deployment options page.
Reporting a security issue
If you think you have found a security vulnerability in HexAI, email [email protected] with as much detail as you can.