Last reviewed: May 2026

Access Control, MFA & Encryption

This page explains who can get into GPWidget, how identities are protected, and how your data is encrypted. It is the public summary of our internal access-control, authentication and encryption measures.

1. Access control & identity management

• Role-based access control (RBAC) — users are granted access only to the information and functionality their role requires.
• Least privilege — applied across all system access.
• Unique accounts — every user has their own account; permissions are managed at organisational and administrative levels.
• Periodic review — access is reviewed regularly and removed promptly when no longer required.

2. Authentication & account security

• Multi-factor authentication (MFA) — a second proof of identity beyond a password — is enforced for all privileged and administrative accounts. It is available to all users and can be enforced organisation-wide for NHS organisations, or any customer whose security policy requires it.
• Secure identity services — credentials are protected in line with industry standards, with enforced password policies.
• Session management controls reduce the risk of unauthorised access.
• Brute-force protection — controls detect and reduce the risk of repeated unauthorised authentication attempts.

3. Encryption

Personal data is protected by encryption both in transit and at rest:

• In transit — all traffic between users and the platform is secured with TLS 1.2 or higher.
• At rest — data is encrypted using AES-256 encryption controls.
• Key management — encryption keys are governed under platform security governance and reviewed on the periodic security review cycle. (Our immutable audit archive additionally uses a customer-managed key — see Data Destruction & Retention.)