Evaluating RotaPulse
You have been asked to check whether RotaPulse can be trusted with your rota and your workers’ fatigue data. This page is written for you: the five questions a reviewer in this space asks, answered with evidence you can verify, and an honest account of what is in place today versus on the roadmap.
The organising principle is that everything here is checkable. Where a control is live, we name the page, file or provider that proves it. Where a certification is not yet held, we say so rather than imply it. Use the Print button to hand this to your procurement, InfoSec or clinical-safety team.
- Engine version
- 2026.07.0
- Engine tests
- 73
- App region
- lhr1
- Data region
- eu-west-2
The five questions a reviewer asks
Evaluators in fatigue and safety run a consistent mental checklist. Here it is, with a direct answer and where to verify each one.
1. Is the science real?
RotaPulse implements the HSE Fatigue and Risk Index, the recognised UK reference, and reproduces the official HSE FRI Calculator's own equations in a line-for-line parity suite. The method is published in full, not a black box, and every score is deterministic: the same inputs always produce the same number, with no AI in the scoring path. Engine 2026.07.0, 73 engine tests.
2. Is my workers' data safe?
Shift and fatigue data is personal and safety-sensitive. It stays in the UK/EEA, every tenant table is isolated with row-level security, connector credentials are encrypted, and the contractual terms are published. We provide a DPIA support pack for your own assessment.
3. Is it secure enough to certify?
Honestly: the verifiable controls are in place today (residency, tenancy isolation, encryption, audited access), and the formal certifications are on a dated roadmap. Cyber Essentials is underway; ISO 27001 is planned. We do not claim a certification we do not hold.
4. Will it stand up to my regulator or auditor?
The regulators (ORR, DVSA, CQC) do not mandate a specific tool; they want a defensible, evidence-based approach. RotaPulse gives you quantification to the recognised HSE method plus a versioned, replayable score history and a dated, exportable report. It is decision-support: it does not discharge your duty of care, it evidences that fatigue risk is assessed and acted on.
5. Can I trust a young vendor?
There is no long customer list to point at yet, so we substitute scale with transparency: the method is open, the engine is regression-tested, the security posture names its own files, the changelog and status page are public, and procurement teams can request time-limited read access to the code itself. You can check everything rather than take it on faith.
Assurance roadmap
The controls a reviewer can verify today, and the formal certifications on the way. We are candid about the difference: a security baseline is underway and the international standard is planned, but we will never show a badge we do not hold.
- LiveUK GDPR alignment
Data Processing Agreement, sub-processor list and privacy policy published; lawful basis and data-subject rights documented.
- LiveUK / EU data residency
Database in eu-west-2 (London), application in lhr1 (London). No processing outside the UK/EEA.
- LiveTenancy isolation (row-level security)
Postgres RLS on every tenant table, scoped by an org_id JWT claim, with a pgTAP cross-tenant test.
- LiveEncrypted connector credentials
Third-party tokens sealed with AES-256-GCM under a server-only key, never stored in plaintext.
- PlannedIndependent penetration test
External test booked to follow the Cyber Essentials assessment; summary letter available to buyers under NDA.
- In progressCyber Essentials
The UK baseline most procurement teams ask for first. Assessment underway, target certification Q3 2026.
- PlannedCyber Essentials Plus
The audited tier, planned once the base certification is held.
- PlannedISO 27001
The international information-security standard, on the roadmap as the enterprise pipeline warrants it.
By sector: the procurement gate you apply
The trust story is the same underneath, but each sector applies its own procurement gate. Here is how RotaPulse maps to yours, with the honest status of each requirement.
Rail and safety-critical
Network Rail supplier assurance, NR/L2/OHS/003, ORR expectations, RSSB good practice
The rail buyer needs a fatigue assessment that stands up to the ORR and maps to the Network Rail fatigue standard. RotaPulse scores every duty to the recognised HSE method and enforces the NR/L2/OHS/003 thresholds directly.
- LiveNR/L2/OHS/003 fatigue thresholds
12h minimum rest, 30-minute break over 8h, a 4 consecutive-night cap, 48h post-night-run rest, applied as the Network Rail compliance profile.
- LiveFatigue Index and Relative Risk to the HSE method
Every duty scored to the recognised UK reference index; parity validated against the official HSE FRI Calculator.
- LiveORR-defensible evidence (plan-do-check-act)
Versioned, replayable scores plus an exportable ORR-ready PDF report and an immutable audit log.
- In progressSupplier security (Cyber Essentials)
The security baseline a Network Rail supplier assessment expects; underway.
NHS and healthcare
Digital Technology Assessment Criteria (DTAC): clinical safety, data protection, security, interoperability, accessibility
The NHS applies DTAC before buying. RotaPulse meets the data-protection and evidence parts today and is honest about the clinical-safety and toolkit items still to complete. It is a workforce fatigue tool, not a patient-facing clinical system, which shapes the clinical-safety scope.
- LiveData protection (UK GDPR, DPA, DPIA support)
DPA, sub-processor list and privacy policy published; we provide a DPIA support pack for your assessment.
- PlannedNHS Data Security and Protection Toolkit (DSPT)
Completed when an NHS pipeline warrants it; the underlying controls (residency, RLS, access control) are already in place.
- PlannedClinical safety (DCB0129)
Scope assessment underway. As a staff-rostering fatigue tool rather than a clinical decision system, the clinical-risk surface is narrow; a safety case and named Clinical Safety Officer are engaged before an NHS clinical deployment.
- In progressTechnical security (Cyber Essentials, penetration test)
Cyber Essentials underway; independent penetration test to follow.
- PlannedAccessibility (WCAG 2.1 AA)
Accessibility audit and conformance statement on the roadmap.
- LiveCQC fatigue evidence
FRI scoring of clinical rotas plus an audit trail and reports that evidence fatigue is assessed and managed as a risk.
Logistics and HGV
DVSA scrutiny, Road Transport (Working Time) Regulations 2005, tachograph evidence
The logistics buyer needs the Road Transport WTD checks and, ideally, scoring against actual driving hours rather than only the plan. RotaPulse runs the WTD checks today, and a driver-card tachograph upload now scores the hours actually driven and worked, not just the plan.
- LiveRoad Transport WTD checks
60-hour single-week cap, 90-hour fortnight, 48h average over a 17-week reference, and per-shift break and rest checks, as the HGV WTD profile.
- LiveScore actual driving hours (tachograph)
A driver-card .ddd upload now reads the hours actually driven and worked onto the matching planned shifts (beta), on the live plan-vs-actual foundation; the card links to a worker on first upload and attaches automatically after. RotaCloud and Deputy connect directly to feed the plan. Vehicle-unit downloads and an analysis-provider feed are next.
- LiveDVSA-defensible evidence
Dated, exportable compliance reports and an immutable audit log per driver and per week.
- In progressSupplier security (Cyber Essentials)
Underway.
RotaPulse is decision-support to a recognised UK method, not a certification. It does not discharge the operator’s duty of care; it gives you the assessment and the paper trail to evidence that fatigue risk is assessed and acted on.
Your evaluation pack and next steps
Everything a buyer’s security, data-protection or clinical-safety team typically asks for, and how to get it.
- Time-limited code audit access
The scoring engine and its tests are the heart of the claim. Procurement teams, DPOs and safety auditors can request read access for a bounded review. Email compliance@rotapulse.co.uk.
- Security questionnaire pack
Long-form questionnaire, CAIQ or Whistic, returned within one business day. See the security posture for the short-form first pass.
- DPIA support pack
A data-protection-impact-assessment support document for your own DPIA: data flows, sub-processors, retention, and lawful basis. Request it at the address above.
- A pilot on your own rota
The fastest way to trust a fatigue tool is to run your real schedule through it. Start free (up to 10 workers, no card) and see a scored grid in about a minute. Start a pilot.