VLMcare is built for regulated environments. This page documents the security controls, certifications, and operational safeguards in place to protect your data and support your regulatory obligations.
VLMcare is hosted on Microsoft Azure and delivered as a validated SaaS platform. Microsoft secures the cloud infrastructure; VLMcare manages application security, customer data protection, and operational controls under a Shared Responsibility Model. Azure provides high availability, multi-layered physical and logical security, enterprise-grade scalability, and continuous infrastructure monitoring.
VLMcare maintains two independent management system certifications, both issued by LRQA: ISO/IEC 27001:2022 (Information Security Management System) and ISO 9001:2015 (Quality Management System). These certifications confirm that VLMcare operates according to internationally recognised standards for governance, risk management, and continual improvement. Both certificates are available for download below.
VLMcare is designed, developed, and maintained to support regulated organisations operating under GxP requirements. The platform supports GLP, GCP, GMP, and GDP. Through validated processes, controlled change management, and comprehensive audit trails, VLMcare helps organisations maintain continuous inspection readiness throughout the system lifecycle.
VLMcare implements multiple layers of technical and organisational controls to ensure the confidentiality, integrity, and availability of customer data.
Access is granted according to the principles of Least Privilege and Need-to-Know.
Access to VLMcare and supporting systems is governed through documented security procedures and centralised identity management.
Security events are centrally monitored using SIEM technology with real-time alerting, prioritisation, and escalation procedures. Monitored events include failed authentication attempts, anomalous login locations, off-hours access activity, and privilege escalation attempts.
VLMcare acts as a data processor and processes personal data in accordance with the General Data Protection Regulation (GDPR). Privacy is integrated into the design and operation of the platform through technical and organisational measures.
Customer data is never used for marketing purposes without explicit consent.
Data processing is transparent and contractually governed.
Personal data collection is limited to operational and security requirements.
Logging is performed solely to protect systems and customer environments.
Issued by LRQA. Valid until 23 July 2027. Scope: developing and delivering GxP compliance Quality Management SaaS.
Issued by LRQA. Valid until 20 March 2028. Scope: providing GxP compliance services and solutions.
Comprehensive overview of VLMcare's security, quality, and compliance posture for customers and auditors.
Certificates are issued to Rescop Corporate B.V., the legal entity behind VLMcare.
Detailed overview of VLMcare's security architecture and controls.
Standard GDPR data processing terms for enterprise customers.
Summary of findings from independent penetration testing.
Completed vendor security assessment, available under NDA.
Security, quality, and regulatory compliance form the foundation of every VLMcare service. VLMcare is committed to information security, regulatory compliance, data protection, business continuity, customer trust, and continuous improvement.