Evaluating RotaPulse
You have been asked to check whether RotaPulse can be trusted with your rota and your workers’ fatigue data. This page is written for you: the five questions a reviewer in this space asks, answered with evidence you can verify, and an honest account of what is in place today versus on the roadmap.
The organising principle is that everything here is checkable. Where a control is live, we name the page, file or provider that proves it. Where a certification is not yet held, we say so rather than imply it. Use the Print button to hand this to your procurement, InfoSec or clinical-safety team.
- Engine version
- 2026.08.0
- Engine tests
- 73
- App region
- lhr1
- Data region
- eu-west-2
The five questions a reviewer asks
Evaluators in fatigue and safety run a consistent mental checklist. Here it is, with a direct answer and where to verify each one.
1. Is the science real?
RotaPulse implements the HSE Fatigue and Risk Index, the recognised UK reference, and reproduces the official HSE FRI Calculator's own equations in a line-for-line parity suite. The method is published in full, not a black box, and every score is deterministic: the same inputs always produce the same number, with no AI in the scoring path. Engine 2026.08.0, 73 engine tests.
2. Is my workers' data safe?
Shift and fatigue data is personal and safety-sensitive. It stays in the UK/EEA, every tenant table is isolated with row-level security, connector credentials are encrypted, and the contractual terms are published. We provide a DPIA support pack for your own assessment.
3. Is it secure enough to certify?
Honestly: the verifiable controls are in place today (residency, tenancy isolation, encryption, audited access). Cyber Essentials is certified (31 July 2026); ISO 27001 is on a dated roadmap. We do not claim a certification we do not hold.
4. Will it stand up to my regulator or auditor?
The regulators (ORR, DVSA, CQC) do not mandate a specific tool; they want a defensible, evidence-based approach. RotaPulse gives you quantification to the recognised HSE method plus a versioned, replayable score history and a dated, exportable report. It is decision-support: it does not discharge your duty of care, it evidences that fatigue risk is assessed and acted on.
5. Can I trust a young vendor?
There is no long customer list to point at yet, so we substitute scale with transparency: the method is open, the engine is regression-tested, the security posture names its own files, the changelog and status page are public, and procurement teams can request time-limited read access to the code itself. You can check everything rather than take it on faith. The related question, what happens to you if we stop, is answered in full below.
Assurance roadmap
The controls a reviewer can verify today, and the formal certifications on the way. We are candid about the difference: a security baseline is underway and the international standard is planned, but we will never show a badge we do not hold.
- LiveUK GDPR alignment
Data Processing Agreement, sub-processor list and privacy policy published; lawful basis and data-subject rights documented.
- LiveUK / EU data residency
Database in eu-west-2 (London), application in lhr1 (London). No processing outside the UK/EEA.
- LiveTenancy isolation (row-level security)
Postgres RLS on every tenant table, scoped by an org_id JWT claim, with a pgTAP cross-tenant test.
- LiveEncrypted connector credentials
Third-party tokens sealed with AES-256-GCM under a server-only key, never stored in plaintext.
- PlannedIndependent penetration test
External test to follow now that the Cyber Essentials certification is held; summary letter available to buyers under NDA.
- LiveCyber Essentials
The UK baseline most procurement teams ask for first. Certified 31 July 2026 by IASME (renewed annually); verifiable on the public register.
- PlannedCyber Essentials Plus
The audited tier, planned once the base certification is held.
- PlannedISO 27001
The international information-security standard, on the roadmap as the enterprise pipeline warrants it.
Continuity: what happens if we go away
RotaPulse is a small vendor and you are being asked to depend on it for a safety process. The fair question is not whether we are any good, it is what happens to you if we stop. Silence on that reads worse than a small answer, so here is the answer in full.
- LiveThe method outlives the vendor
The scoring is the HSE Fatigue and Risk Index, a published UK standard, not a proprietary model of ours. If RotaPulse stopped existing tomorrow, the method you have been assessing against is still there, and your historical assessments can be reproduced independently from exported data.
- LiveYour data comes out in full, on any plan
Self-serve CSV export is a paid-plan and trial feature. A complete export of your rotas, scores and audit log is available on request on any plan, including free, and is never withheld or charged for. Compliance reports export as dated PDFs.
- Live90 days' notice and a refund if we wind down
If TeZe Ltd ever stops trading, customers get at least 90 days' notice, a refund of any prepaid time, and a full data handover before anything is switched off. A commitment, not an intention.
- LiveSource code escrow on request
For organisations that need it as a condition of contract, at the customer's cost. Email compliance@rotapulse.co.uk and it will be arranged with a UK escrow agent.
- LiveKey-person risk, named rather than hidden
RotaPulse is built and run by one person at TeZe Ltd, a UK registered company (no. 17137231), Cyber Essentials certified and ICO registered. We would rather you priced that in now than discovered it in year two. Time-limited code audit access exists so the engine is never a black box you depend on.
The same commitments are published at company level on teze.app/trust, alongside the company, tax and ICO registrations.
By sector: the procurement gate you apply
The trust story is the same underneath, but each sector applies its own procurement gate. Here is how RotaPulse maps to yours, with the honest status of each requirement.
Rail and safety-critical
Network Rail supplier assurance, NR/L2/OHS/003, ORR expectations, RSSB good practice
The rail buyer needs a fatigue assessment that stands up to the ORR and maps to the Network Rail fatigue standard. RotaPulse scores every duty to the recognised HSE method and enforces the NR/L2/OHS/003 thresholds directly.
- LiveNR/L2/OHS/003 fatigue thresholds
12h minimum rest, 30-minute break over 8h, a 4 consecutive-night cap, 48h post-night-run rest, applied as the Network Rail compliance profile.
- LiveFatigue Index and Relative Risk to the HSE method
Every duty scored to the recognised UK reference index; parity validated against the official HSE FRI Calculator.
- LiveORR-defensible evidence (plan-do-check-act)
Versioned, replayable scores plus an exportable ORR-ready PDF report and an immutable audit log.
- LiveSupplier security (Cyber Essentials)
The security baseline a Network Rail supplier assessment expects; certified 31 July 2026.
Logistics and HGV
DVSA scrutiny, Road Transport (Working Time) Regulations 2005, tachograph evidence
The logistics buyer needs the Road Transport WTD checks and, ideally, scoring against actual driving hours rather than only the plan. RotaPulse runs the WTD checks today, and a driver-card tachograph upload now scores the hours actually driven and worked, not just the plan.
- LiveRoad Transport WTD checks
60-hour single-week cap, 90-hour fortnight, 48h average over a 17-week reference, and per-shift break and rest checks, as the HGV WTD profile.
- LiveScore actual driving hours (tachograph)
A driver-card .ddd upload now reads the hours actually driven and worked onto the matching planned shifts (beta), on the live plan-vs-actual foundation; the card links to a worker on first upload and attaches automatically after. RotaCloud and Deputy connect directly to feed the plan. Vehicle-unit downloads and an analysis-provider feed are next.
- LiveDVSA-defensible evidence
Dated, exportable compliance reports and an immutable audit log per driver and per week.
- LiveSupplier security (Cyber Essentials)
Certified 31 July 2026.
NHS and healthcare
Digital Technology Assessment Criteria (DTAC): clinical safety, data protection, security, interoperability, accessibility
The NHS applies DTAC before buying. RotaPulse is a workforce fatigue tool, not a patient-facing clinical system, which narrows the clinical-safety scope. The data-protection, security and evidence parts are live today; the remaining DTAC items (DSPT, a DCB0129 clinical safety case, a WCAG 2.1 AA audit) are completed when an NHS deployment calls for them, and the full mapping is available on request.
- LiveData protection (UK GDPR, DPA, DPIA support)
DPA, sub-processor list and privacy policy published; we provide a DPIA support pack for your assessment.
- In progressTechnical security (Cyber Essentials, penetration test)
Cyber Essentials certified 31 July 2026; independent penetration test to follow.
- LiveCQC fatigue evidence
FRI scoring of clinical rotas plus an audit trail and reports that evidence fatigue is assessed and managed as a risk.
RotaPulse is decision-support to a recognised UK method, not a certification. It does not discharge the operator’s duty of care; it gives you the assessment and the paper trail to evidence that fatigue risk is assessed and acted on.
Your evaluation pack and next steps
Everything a buyer’s security, data-protection or clinical-safety team typically asks for, and how to get it.
- Time-limited code audit access
The scoring engine and its tests are the heart of the claim. Procurement teams, DPOs and safety auditors can request read access for a bounded review. Email compliance@rotapulse.co.uk.
- Security questionnaire pack
Our standard security documentation is available for review. Customer-specific questionnaires require a separately agreed scope and turnaround. See the security posture for the short-form first pass.
- DPIA support pack
A data-protection-impact-assessment support document for your own DPIA: data flows, sub-processors, retention, and lawful basis. Request it at the address above.
- A pilot on your own rota
The fastest way to trust a fatigue tool is to run your real schedule through it. Start free (up to 10 workers, no card) and see a scored grid in about a minute. Start a pilot.