Independent audit · Leeds
Every year someone asks you to show that patient and client data is protected. We answer it once, evidence it properly, and keep the answer current all year.
No charge. No obligation. No access to your systems.
Findings from an example free audit
Without DMARC there is no instruction to receivers about what to do with spoofed mail, and no reporting, so an impersonation campaign against your patients could run without you ever knowing.
What to doPublish a DMARC record at p=none with an rua address, review the reports, then move to p=quarantine and p=reject.
Free instant check
Type in your website and we read your public email records (SPF, DKIM and DMARC) and tell you in plain English. It takes a few seconds, needs no email address and touches nothing on your systems.
The situation
It arrives in different envelopes, but it is always the same: can you show us the personal data you hold is protected, and can you prove it.
| Who asks | When | What a weak answer costs you |
|---|---|---|
| NHS England, via the DSPT | Every year, 30 June | Your NHS contract is put at risk |
| Your insurer | At renewal | Higher premium, added exclusions, or cover declined |
| Local authority commissioners | Every tender | Scored down or removed from the process |
| CQC or Ofsted | At inspection | A finding recorded against you |
| A patient or family member | Without warning | A complaint that escalates to the ICO |
| The ICO, after an incident | Rarely, but it happens | A reprimand, or a penalty |
The DSP Toolkit moved to outcome-based evidence. Holding a policy is no longer enough; you have to show the control described in it actually operates, and produce the records that prove it. Read our plain-English DSPT guide →
What we check
26 automated technical checks and 59 documentation review criteria, covering all ten National Data Guardian standards behind the DSPT and all five Cyber Essentials controls.
Everything about your organisation reachable from the internet, assessed without any access to your systems.
We load your site in a real browser and record what happens before anyone agrees to anything.
The half no scanner reaches, and where most of the real risk sits.
Assessed on evidence your IT provider produces. We check it against the standard and write it up.
What you receive
Written to be read by a practice manager, not an IT specialist, and presentable to an insurer, a commissioner or an inspector.
Every issue rated by severity and effort, with a named owner: you, your IT provider, or us.
Each finding tied to the DSPT standard, Cyber Essentials control or UK GDPR article it affects.
Your supporting documentation assembled, indexed and kept current against expiry dates.
What to do, in what order, and roughly how long each item takes.
Written confirmation of everything resolved since. Your record of action taken.
One page your partners or trustees will actually read.
How it works
Thirty minutes. What you hold, who asks you to prove it, what deadline you are working to. No charge and no obligation.
We assess your public web and email presence and send you the findings. You see the quality of the work before you spend anything.
Before anything active happens we agree exactly what will be tested, when, and how to stop it. Nothing proceeds until you have signed.
Two to three weeks. Technical assessment, documentation review and evidence assembly.
We talk you through it in plain terms, with your IT provider present if that helps.
Re-test at 60 days. On a retainer we then keep the evidence current and handle the annual submission.
Scope
We assess and evidence. Your IT provider implements. That division is deliberate, and it is why IT providers tend to welcome us: we take the governance paperwork off their desk and leave them the technical work.
Where a client needs penetration testing we introduce them to a CREST-registered partner rather than stretching our own scope.
Founder, Unavoidably Secure
Who does the audit
Unavoidably Secure is led by Andrew Heppinstall. Andrew has spent more than fourteen years building websites, systems and marketing for UK businesses, including dental and healthcare practices, so he knows where their websites, email and paperwork tend to fall short.
Andrew and the team carry out every audit themselves. Nothing is passed to a subcontractor, and the documents and findings you share stay on our own UK-hosted systems, encrypted at rest and released only to the people you name.
We work alongside your IT provider, never instead of them. You get a straight answer about where you stand, in plain English, from someone you can pick up the phone to.
Investment
No hourly rates. We quote a fixed fee once we know the size of your organisation and which standards apply to you.
Assessment of your public web and email surface, delivered as a written report.
All four components, evidence pack, remediation plan, and a re-test at 60 days.
Everything above, plus DSPT or Cyber Essentials evidence assembly and support through to submission.
Continuous monitoring, quarterly re-assessment, evidence kept current, annual submission handled.
Where you move from an audit onto ongoing assurance, the first months of the retainer are discounted against the audit fee.
Questions
Not for the free audit. It only looks at what anyone on the internet can already see about your website and email. In a paid audit your internal systems are assessed on evidence your IT provider produces, and nothing active is ever tested until you have signed a written authorisation saying exactly what, when and how to stop it.
No. The Data Security and Protection Toolkit is submitted by your organisation. We assess where you stand against it, assemble the evidence, and on our Standards readiness package we support you right through to submission.
Yes, and most IT providers welcome it. We check and evidence; they carry out the technical fixes. We are happy to have them on the report walkthrough so everyone agrees what needs doing and who owns it.
We offer a 30 minute call to walk you through it. If you want help beyond that, we quote a fixed fee based on the size of your organisation and the standards that apply. There is no obligation, and the report is yours to keep either way.
No assessment certifies compliance with any standard, and we are not a Cyber Essentials certification body. We get you ready: we find the gaps, help you close them and assemble the evidence, so that your DSPT submission or certification goes through first time.
The free external audit report arrives within five working days. A full audit usually takes two to three weeks, depending on how quickly your documents and IT evidence come through.
Andrew Heppinstall and the team at Unavoidable Studio Ltd in Leeds. You will have a direct line to the person doing the work: 07749 941111 or support@unavoidablysecure.com.
Start here
No charge, no obligation, and no access to your systems. You see the quality of the work before you commit to anything.