Compliance · security · audit

Audited, certified, current.

OndLingua operates as a regulated processor under UK GDPR, EU GDPR and US HIPAA. We renew on schedule, publish certificates on request, and ship an audit pack with every onboarding.

01Certifications

Eight certifications, six live today.

Every line below is honest about its current status — valid, in progress under audit, or formally on the roadmap. We publish renewal dates as we receive them.

GDPR
EU / UK data protection
Data Processing Agreement (DPA), Records of Processing (ROPA), SCCs for international transfers. EU and UK representatives on file.
Compliant · audited Mar 2025
EU 2016/679 · UK GDPR
Scope · EU + UK
ISO 27001
Information security
Full ISMS — risk register, access control, change management and supplier review. Stage 1 audit complete; Stage 2 audit scheduled.
On roadmap · Stage 2 audit Q3 2026
BSI · ISO/IEC 27001:2022
Scope · Global
DSPT
NHS Data Security & Protection
Standards Met for the current year — covers data flows, training, breach response and supplier assurance across all NHS engagements.
Standards met · renewed annually
NHS Digital
Scope · UK NHS
Cyber Essentials Plus
Government cyber baseline
External and internal testing of perimeter, endpoint hardening and patch posture. Renewed every twelve months under the IASME-NCSC scheme.
Certified · valid to Feb 2027
IASME · NCSC scheme
Scope · UK government
HIPAA
US healthcare data
Business Associate Agreement (BAA) available for US covered entities. Administrative, physical and technical safeguards mapped to 45 CFR 160 / 164.
Compliant · BAA on request
BAA · US covered entities
Scope · US healthcare
SOC 2 Type II
Service Organization Controls
Trust Services Criteria — security, availability, processing integrity, confidentiality. Twelve-month observation window in progress.
In progress · audit Q4 2026
AICPA-aligned auditor
Scope · US / Global enterprise
ISO 9001
Quality management
Service delivery, interpreter recruitment and QA workflows independently audited. Closed-loop corrective action and continuous improvement.
Certified · valid 2025
BSI · ISO 9001:2015
Scope · Global
PCI DSS
Payment card data
Self-Assessment Questionnaire (SAQ-A) — payment card data is fully outsourced to PCI Level-1 processors; no card data touches OndLingua systems.
SAQ-A · current attestation
PCI SSC
Scope · Global

02Privacy commitments

Six things we always do.

These are not negotiable per client — they apply across every contract, every region, every sector. Codified in the DPA you sign with us.

01
Encryption everywhere
TLS 1.3 in transit. AES-256-GCM at rest. Keys rotated on a schedule; HSM-backed for production secrets.
02
Recordings off by default
No call is recorded unless explicitly enabled by the institution and consented to by both parties. Default retention thirty days, configurable per client.
03
Minimum necessary data
We collect what routing and audit require — institution, station, language, duration. No transcript storage by default; no profiling.
04
Right-to-be-forgotten
Subject access and erasure requests fulfilled within thirty days. Backups purged on the next cycle, with audit trail.
05
Sub-processor transparency
Public register of every sub-processor with their role and residency. Thirty-day notification window before any addition or material change.
06
Breach notification within 72 hours
Defined incident-response runbook, on-call rota, executive escalation. Notification to controllers within seventy-two hours of confirmation, per GDPR Article 33.

03Data residency

Your data, your region.

Choose UK, EU, US or APAC residency at onboarding. Routing, recordings and audit logs stay within the chosen region; cross-border transfers require explicit consent and SCCs.

UKLondon (LHR), Manchester (MAN) — AWS eu-west-2
EUFrankfurt (FRA), Dublin (DUB) — AWS eu-central-1, eu-west-1
USVirginia (IAD), Oregon (PDX) — AWS us-east-1, us-west-2
APACSingapore (SIN), Tokyo (NRT), Sydney (SYD)

04Assurance pack

Everything your DPO needs.

Submitted under NDA, refreshed quarterly, and indexed against ISO 27001, SOC 2 and the NHS DSPT toolkit.

Latest ISO 27001 and SOC 2 reports under NDA
Data Processing Agreement (DPA) and Standard Contractual Clauses
Sub-processor register and change-notification mailing list
Pen-test summary — annual, third-party tested
Business continuity and disaster-recovery runbook
Data Protection Impact Assessment (DPIA) template

Vendor assessment

Request the assurance pack.

Sent under NDA within one working day to your DPO or security team.

Request the pack