Customer trust and data security are critical to everything we do at Birdie.

Birdie has achieved Cyber Essentials certification and meets the NHS Data Security and Protection Toolkit standards.

Product security

Secure access

Login to Birdie is secured by a one-time authentication link.

Permissions

We enable permission levels within the app to be set for your staff. Only carers who've been invited by the care agency can access customers information.

Uptime

We have uptime of 99.9% or higher.

Network and application security

Data Hosting and Storage

Birdie services and data are hosted in Amazon Web Services (AWS) facilities (eu-west-2) in the UK.

Failover and DR

Birdie was built with disaster recovery in mind. All of our infrastructure and data are spread across 2 AWS availability zones and will continue to work should any one of those data centers fail.

Virtual Private Cloud

All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests getting to our internal network.

Backups

Database backups of Birdie’s production system are taken regularly and prior to any major upgrade or configuration change to Birdie’s production environment. These backups allow, in the event of a disaster, the creation of a replica environment within a minimal period of time.

Monitoring

Birdie uses multiple internal and 3rd-party tools for monitoring its production environment and protecting it against potential threats or errors:

  • An internal notification mechanism is in place to alert Birdie operations and support teams on different anomalies detected in production.
  • AWS analytics tool is configured to continuously monitor Birdie’s production environment status, including server availability, CPU, memory, disk space and other key metrics; the Cloud Monitoring tool also sends alerts to Birdie’s operations team based on preconfigured policies.
  • ELK is used for continuous log monitoring and archiving
  • New Relic is used for live production monitoring
  • Sentry is used for live production bug and regression tracking

An internal production monitoring dashboard aggregates information from Birdie’s multiple systems and provides Birdie operations personnel with a clear view of Birdie’s production environment status. Birdie also operates a support ticketing system allowing administrators and end-users to report any issues or errors they encounter while using Birdie’s web-based solution.

Permissions and Authentication

Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required.
All-access to personal confidential data on IT systems can be attributed to individuals and logged. The principle of ‘least privilege’ is applied, so that users do not have access to data they have no business need to see.
We have Single Sign-on (SSO), 2-factor authentication (2FA) and strong password policies on GitHub, Google, AWS to ensure access to cloud services are protected.

Encryption

All data sent to or from Birdie is encrypted in transit using 256-bit encryption. Our API and application endpoints are TLS/SSL only and score an “A” rating on Qualys SSL Labs‘ tests. We also encrypt data at rest using an industry-standard AES-256 encryption algorithm.

Pentest

Our dedicated infrastructure team is in charge of ensuring our platform is secure and available at all time. Once a year we engage third-party security experts to perform detailed penetration tests on the Birdie application and infrastructure (Last penetration test has been performed in November 2019 by KPMG).

24/7 Incident Response

We recognise that Birdie may be critical to the well-being of your customers and business. Reason why we have on-call engineers available at all time.
Birdie implements a protocol for handling security events which includes escalation procedures, rapid mitigation and post mortem. All employees are informed of our policies.

Additional Security features

Training

All employees complete Security and Awareness training annually as part of the commitment to NHS DSP toolkit.
Our staff by whom the shared personal data is to be handled and processed are appropriately trained to do so in accordance with the Data Protection legislation.

Policies

Birdie has developed a comprehensive set of security policies covering a range of topics. These policies are updated frequently and shared with all employees.

Confidentiality

All employee contracts include a confidentiality agreement.

Payments

All payments made to Birdie go through one of our partners, GoCardless or Stripe. Details about their security setup can be found at GoCardless's security page or Stripe's security page.

Security questions?

If you think you may have found a security vulnerability, please get in touch with our team at support@birdie.care.