Everything a procurement questionnaire asks is on this page, in writing, with the honest partials marked as partials. The record below is the live one, not a screenshot.
Booking service
99.98%Last 60 days
No data leaves the region you select at sign-up, including backups. The list of every company that touches it is published and versioned, and you are told thirty days before it changes.
The plain facts
Figures are from the last twelve months and are updated on the first working day of each quarter.
Sites on this plan
United KingdomBramble Health
Bristol
Kingsway Clinic
Leeds
Harbour Practice
Southampton
This is the same document we return to procurement teams. Three answers are partial and they are marked as partial, with what is missing and when it lands.
Is access scoped by role?
YesEvery permission is attached to a role, and a request to widen one is recorded with who approved it and why.
Do you support single sign-on?
YesSAML and OIDC on the Group plan, with SCIM provisioning and de-provisioning.
Is multi-factor authentication enforced?
PartialAvailable on every plan and enforceable per practice. Enforcing it across an entire group from one switch lands in the first quarter.
Is data encrypted at rest and in transit?
YesAES-256 at rest, TLS 1.3 in transit, with keys rotated annually.
Can we choose where data is stored?
YesLondon or Dublin, chosen at sign-up and fixed after it. Backups never leave the region.
Can we export everything?
YesOne click in settings, in a format another system can read, with no ticket and no exit fee.
Do you offer customer-managed encryption keys?
Not yetNot today, and we will say so rather than imply otherwise. It is not on the roadmap for this year.
Is there an immutable audit log?
YesEvery read and write against a member record, kept for six years and exportable in full.
How quickly are incidents disclosed?
YesWithin 24 hours to affected practices, publicly on the status page, with a written post-mortem inside five working days.
Do you penetration test?
PartialAnnual third-party test with the summary available under NDA. Quarterly testing begins this year.
The full questionnaire, the audit summary, our sub-processor list and the standard data processing agreement, in one download. No form and no sales call attached to it.
Questions and answers are published on this page, attributed to the practice that asked unless they would rather not be. If the answer is unflattering it goes up anyway.
Answered within two working days by a named engineer, then published here with your name only if you allow it.
“What happens to our data if we stop paying?”
The account goes read-only for thirty days so you can export everything, then it is deleted and the deletion is confirmed in writing. We never hold data hostage against an invoice.
Ridgeway Family Health
“Has Sirius ever had a breach?”
No breach of member data. We had a two-hour outage in March 2025 caused by our own migration, the post-mortem is on the status page, and nothing was lost.
Northgate Clinics
“Do your engineers see our records?”
Only on a support request, only with a named approver, and every one of those sessions is in your audit log with the reason attached.
Eastgate Health
“Who owns the data we put in?”
You do, in the contract as well as in principle. We are a processor, you are the controller, and the agreement says so in the first clause rather than the fortieth.
A group that asked not to be named
Thirty minutes with the engineer who maintains this page, not an account manager reading from it. Bring your own document and we will go through it line by line.
Who you would speak to
Priya Nandan
Security engineer
Free from 09:30 today
No sales team on the call unless you ask for one.
A trust page that answers the review before it is sent: an inverted hero floating a live uptime record, the hosting and retention facts in plain rows, a full security questionnaire with partial answers marked as partial, a public ask-and-answer panel, a booking panel for the engineer who wrote it, and a minimal footer.
Composed from 7 blocks. Installing this page installs all of them, plus the pieces and primitives they use.
Built in the Sirius collection.
A trust page that answers the review before it is sent: an inverted hero floating a live uptime record, the hosting and retention facts in plain rows, a full security questionnaire with partial answers marked as partial, a public ask-and-answer panel, a booking panel for the engineer who wrote it, and a minimal footer. Seven blocks, one install.
Upgrade to Pro
Pro blocks install through the shadcn CLI with your license key and ship their full source. Docs and live previews stay open to everyone, so you can read every block's details first.
Swap YOUR_EMAIL and YOUR_KEY for the email and license key on your account. Find your license key on your account page.
npx shadcn add "https://ui.beste.co/page/r/security1?email=YOUR_EMAIL&license_key=YOUR_KEY"This installs the page to components/beste/page/security1.tsx and everything behind it: the seven blocks it composes (navbar72, hero160, about72, faq90, faq91, cta86, footer121), the five components they use (indicator14, location8, card31, button21, badge23) and the shadcn/ui input, textarea and button primitives. Thirteen files.
The installed file exports security1Demo alongside the page: the exact props behind the preview above. Spread it to get a working page in one line.
import { Security1, security1Demo } from "@/components/beste/page/security1";
export default function Page() {
return <Security1 {...security1Demo} />;
}Each section is a separate prop, so the usual next step is to keep the demo and replace one section at a time. On this page the facts are what change.
import { Security1, security1Demo } from "@/components/beste/page/security1";
export default function Page() {
return (
<Security1
{...security1Demo}
facts={{
label: "The facts",
heading: "Where your data lives, and for how long.",
facts: [
{ term: "Hosting", detail: "Frankfurt and Dublin, both in the EU." },
{ term: "Retention", detail: "Deleted records are gone from backups within 30 days." },
{ term: "Sub-processors", detail: "Four, listed with what each one sees." },
],
}}
/>
);
}Every prop is the full prop object of the block that renders that section, so anything the block accepts is accepted here.
| Prop | Type | Default | Description |
|---|---|---|---|
navbar | ComponentProps<typeof Navbar72> | – | Product navbar |
hero | ComponentProps<typeof Hero160> | – | Inverted hero floating an uptime record |
facts | ComponentProps<typeof About72> | – | Hosting and retention, in plain rows |
controls | ComponentProps<typeof Faq90> | – | Security questionnaire, grouped |
questions | ComponentProps<typeof Faq91> | – | Public ask-and-answer panel |
cta | ComponentProps<typeof Cta86> | – | Booking panel for the engineer who wrote it |
footer | ComponentProps<typeof Footer121> | – | Minimal footer |
className | string | – | Extra classes for the page's outer wrapper |
| Section | Block | Notes |
|---|---|---|
| Navbar | navbar72 | Sticky for the whole document |
| Hero | hero160 | Dark inside the block already, with a live uptime record floating in it |
| Facts | about72 | Given bg-muted/40; term and detail rows, no prose |
| Controls | faq90 | The questionnaire, in a two-column grid of groups |
| Questions | faq91 | Also given bg-muted/40; carries the ask-a-question fields, hence the input and textarea dependencies |
| Booking | cta86 | Links to a booking page; no form of its own |
| Footer | footer121 | Minimal, so the page ends on the booking panel |
questions removes that section entirely rather than rendering an empty one.dark wrapper on this page even though it opens dark: hero160 is already inverted inside the block, so wrapping it would invert an inversion and hand back a light hero.sticky top-0 z-50 by the page, which works because the block carries its own opaque band.className="bg-muted/40" on both the facts and questions sections after spreading their props, so a className passed inside those props is overridden.faq90 lays its groups out in a two-column grid, so an odd number of control groups leaves one cell empty on the last row. Three groups is the count that shows it most.faq91), which is where the input and textarea dependencies come from. The booking panel below it is links, not a form.Wiring the form up
The ask-a-question panel ships as markup, not as a wired form. For validation and submission, see React Hook Form, TanStack Form, and Formisch.
navbar72
A minimal navbar with a lowercase wordmark, absolutely centered uppercase text links, an accent call to action, and a collapsing mobile menu.
hero160
A hero built as one dark panel: a light display heading, two actions, and a hairline table of service commitments beside a bordered image column that floats a live uptime strip.
about72
An about section on a soft surface that opens on a light statement, then lays out eight company facts as a two-column hairline definition list beside an image tile floating a live locations card.
faq90
A procurement FAQ grouping security controls into hairline rows that pair each question with a tone-coded yes, partial, or not-yet chip and the detail behind it, closing on a security pack request.
faq91
An open question FAQ pairing a soft panel that sticks while you scroll, holding a working question and email form, with the questions others sent recently answered as linked hairline entries.