Security details, in full.
The full breakdown of how we protect customer and learner data. If anything is missing for your procurement team, ask us.
Security your IT team will approve.
Node XR meets the security, compliance, and governance standards NHS trusts, universities, and enterprise procurement teams require.
Cyber Essentials Plus
UK Government-backed certification. Independently verified security controls.
AWS UK hosting
AES-256 at rest, TLS 1.2+ in transit. eu-west-2 London region.
SSO & MFA
SAML 2.0, OpenID Connect, Google & LinkedIn SSO. MFA on every account.
Role-based permissions
Creator, admin, and learner roles with full audit logging.
xAPI & SCORM
Scores sync to Moodle, Canvas, Blackboard, and Teams. CQC and Ofsted evidence.
GDPR & UK data residency
No data leaves UK jurisdiction. 24-hour breach notification SLA.
Hosting & data residency
Node XR is hosted entirely on AWS in the eu-west-2 (London) region. No customer data leaves UK jurisdiction at any point. Backups are encrypted and replicated across multiple availability zones within the UK.
Encryption
AES-256 encryption at rest for all stored data. TLS 1.2+ enforced for all data in transit. Encryption keys managed via AWS KMS with rotation policies.
Authentication
SAML 2.0 and OpenID Connect SSO supported on Scale tier. Google and LinkedIn SSO supported on all paid tiers. Multi-factor authentication enforced on every administrative account.
Access control
Role-based permissions with three primary roles (Creator, Admin, Learner). Full audit logging of all administrative actions. Per-scenario access controls and time-limited share links.
Certifications
Cyber Essentials Plus certified annually. ISO 27001 alignment in progress. NHS Data Security and Protection Toolkit (DSPT) compliant.
Breach notification
24-hour breach notification SLA per UK GDPR Article 33. Documented incident response procedure. Customers notified directly within the SLA window.
Need a procurement-ready pack?
DPA, SOC alignment, architecture diagrams, and DSPT evidence available on request.