Security and data protection by design.

Security built into the service

OVARA uses layered, risk-based safeguards across the platform. Security measures are reviewed as the service, threat landscape and legal requirements develop, supporting the prevention, detection and management of security events.

International data-protection framework

OVARA’s governance framework is designed to support the data-protection requirements relevant to each service and customer. This includes Regulation (EU) 2016/679 (EU GDPR), the UK GDPR and Data Protection Act 2018, and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where applicable, contractual and operational controls can also reflect DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021.

The framework addresses core principles including lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; confidentiality and accountability. It also supports privacy by design and default, controller–processor terms, records of processing, risk assessment, security of processing, incident management, individual rights and lawful international transfers. The precise requirements depend on the parties’ roles, the processing, the data and the jurisdictions involved.

Secure AWS cloud foundation

OVARA uses Amazon Web Services (AWS) as part of its hosting and security architecture. AWS protects the underlying cloud infrastructure, while OVARA securely configures and operates the services used by the platform under the AWS shared-responsibility model.

AWS maintains independently audited assurance programmes for in-scope services, including ISO/IEC 27001:2022 for information-security management, ISO/IEC 27017:2015 for cloud-security controls, ISO/IEC 27018:2019 for protection of personally identifiable information in public clouds and ISO/IEC 27701:2019 for privacy-information management. The certification scope applies to the AWS services and regions identified by AWS. OVARA builds on that independently assessed cloud foundation with its own access, encryption, monitoring, backup, recovery and governance controls.

Clear protection and governance

OVARA is responsible for securing the platform and protecting the data entrusted to it in line with the agreed service and data-processing terms. Each licensed organisation defines its regulatory purpose, confirms the information and instructions used in its cases and authorises the users who may act for it. OVARA applies the platform controls that enforce those permissions and preserve a traceable record of access and activity.

Layered platform controls

The platform combines separation of public and secure environments, encrypted transport, organisation and role-based access, least-privilege design, evidence provenance, audit history, controlled releases, backups, recovery planning, monitoring and incident management. Controls are applied according to the service, the data and the assessed risk.

Authorised user oversight

Platform tools help authorised users organise evidence, identify matters for review and apply approved procedures consistently. Material compliance conclusions, risk decisions, approvals and regulatory actions remain with the licensed organisation’s authorised reviewers, supported by a clear record of the information considered.