How we host and protect your practice website
Your practice website holds public information only: no patient records and no patient data. We host it on managed cloud services, back it up every day, and record the changes your team makes.
Hosting
Sites run on Vercel, over HTTPS only, with security updates applied by us. Content is stored in a managed PostgreSQL database at Supabase, in London (UK).
Backups
The database is backed up every day.
Access control
Each member of your team signs in with their own account, and only your practice’s accounts can change your site.
Monitoring, day and night
Live alert monitoring watches every practice website, day and night. If one stops responding, we’re alerted straight away, so we’re first to know.
Safe updates
Every update to the platform is tested on a private copy first, then checked again once live. If a practice site fails that check, the update is rolled back automatically.
Audit log
Changes to your site are recorded with who made them and when.
No patient data
We don’t store patient data on your website. Online consultations, prescriptions and registration happen in the NHS services and tools you already use.
Certifications
We don’t hold paid security certificates. We plan to complete the NHS Data Security and Protection Toolkit (DSPT).
Questions about security
If your ICB or IG lead needs more detail for a data protection impact assessment, email hello@mysurgery.site.
Questions about security? Talk to us.
A 20-minute call, no obligation. We'll answer your questions and look at your current site with you.