Access Control & Security

Access Control and Information Security Compliance

The right people see the right data. Nobody else.

Developed for the NHS by the NHS

Role-based access control

Securing sensitive estate data requires strict governance. ECO operates as a role-based access control healthcare software solution, enforcing defined user permissions natively across the platform.

Strict tenant isolation

Each client organisation's data is isolated at the data layer. ECO scopes every record to its tenant, so users only ever see the data belonging to the organisations they're authorised for.

Multi-Factor Authentication

Passwords alone are insufficient for protecting critical infrastructure records. ECO enforces multi-factor authentication across the entire user base to mitigate credential-based security risks.

MFA/TOTP Enforcement

All users must authenticate via Time-Based One-Time Passwords (TOTP) during the login process.

One-click user deactivation

Managing workforce turnover and contractor offboarding requires immediate administrative control. In compliance with NHS Vendor Security Point 5.4 user deactivation standards, ECO provides a definitive mechanism to terminate user access instantly.

Rapid offboarding

System administrators can revoke access in a single action, preventing orphaned accounts from remaining active post-contract.

Immediate Session Revocation

Deactivating a profile revokes access immediately- the user is locked out on their next request and can no longer read, modify, or export any estate data.

Explore the platform