Trust and compliance

Rotapulse is a safety tool. Every claim on the homepage is tied to something you can inspect: a file in the repo, a test, a config value, a database policy. This page names each one.

Been asked to formally evaluate RotaPulse for procurement, InfoSec, data protection or clinical safety? Start at the evaluator trust centre: the five questions a reviewer asks, an honest assurance roadmap, and a per-sector procurement map for rail, NHS and logistics.

Deterministic by default

HSE FRI scoring is pure, versioned, regression tested. Every number is reproducible from history.

Engine version 2026.07.0, pinned in src/lib/fri-engine/version.ts
73 engine tests, including a line-for-line parity suite against the official HSE FRI Calculator
Every stored ShiftScore carries fri_version + profile_version for replay

AI narrates, never decides

The model explains and suggests. The deterministic engine re-validates every suggestion before you see it.

No LLM call on the scoring path. Scores are produced by pure TypeScript.
LLM suggestions pass through scoreShift() before surfacing in the UI
AI is off by default: requires platform switch (platform_config.ai_enabled) AND per-workspace opt-in

UK compliant, UK hosted

EU region Supabase, UK Vercel region, GDPR by design. Built for NHS, logistics, rail subcontractors, hospitality.

Supabase project in eu-west-2 (London)
Vercel regions locked to lhr1 (London) in vercel.json
Row-level security on every table, JWT-scoped by org_id (see policies in 0001_initial_schema.sql)

Runtime facts

What this instance reports about itself, live. If any of these look wrong for a UK customer, the deploy is misconfigured.

FRI engine version: 2026.07.0
Default profile: general@1.0
Vercel region: lhr1
Supabase region: eu-west-2
Engine tests: 73
Ingest tests: 589
Total tests: 1126

Code audit

The repository is private. Procurement teams, DPOs, and HSE auditors can request read access for a time-limited review. Email compliance@rotapulse.co.uk with your organisation name and what you need to verify. We respond within two working days.

An audit session gives you direct access to:

src/lib/fri-engine/The complete FRI scoring engine. Pure TypeScript, no network calls, deterministic for any input.
src/lib/fri-engine/__tests__/rr446-examples.test.tsRegression tests that pin the engine to the fatigue relationships RR446 establishes, alongside a parity suite (fri-engine/hse) that reproduces the official HSE FRI Calculator's own equations. You can run them and check the pass/fail yourself.
src/lib/ingest/Ingest pipeline. Handles normalisation, worker matching, and format validation before any scoring.
supabase/migrations/All database migrations in order, including RLS policies on every table and the AI gate logic.

Legal backing

The UK/GDPR pillar above is supported by the following documents, available on request or at the links below.

Data Processing Agreement - covers Rotapulse's obligations as your data processor, including sub-processor commitments with Anthropic (zero-retention, EU region).
Sub-processor list - Supabase, Vercel, Anthropic, Resend. Region, retention period, and contractual basis for each.
Privacy policy - lawful basis, data subject rights, retention periods.
Data protection complaints - how to complain, what we do, ICO escalation. Section 164A DPA 2018 / DUAA 2025.