Quick answer: we built Unavoidably Secure because dental practices, care providers and small charities have to prove their data is safe, usually without an IT or compliance team. Unavoidably Secure gives them an independent audit, a written report they can hand to someone and a plan to close the gaps, starting with a free external check.
- Small regulated teams face several overlapping standards at once: the DSPT, Cyber Essentials, UK GDPR and PECR.
- Unavoidably Secure answers those questions once, evidences them properly and keeps the answer current.
- It is an audit and readiness service, not a certification body, and it says so plainly.
Unavoidable Studio builds and runs several products, and each one starts with a specific group of people and a job they find hard. This is the story of why we built Unavoidably Secure, written as part of building in public. Product details here were checked on the live unavoidablysecure.com site and its portfolio page on 3 November 2026.
What problem does Unavoidably Secure solve?
It solves the problem of proving data security when nobody in the building owns it. A dental practice or care home holds sensitive records about patients and residents, and it is expected to show that those records are protected. Most have no in-house IT or compliance team, so the evidence ends up spread across a practice manager, an outside IT provider and a filing cabinet.
The questions also come from several directions at once. Organisations that work with NHS data complete the Data Security and Protection Toolkit every year; the DSPT site says plainly that "all organisations that have access to NHS patient data and systems must use this toolkit". Contracts often ask for Cyber Essentials, which the NCSC describes as "the minimum standard of cyber security recommended by the Government" and which rests on five technical controls. On top of that sit UK GDPR and the PECR rules for websites and marketing.
Who is Unavoidably Secure for?
It is for dental practices, care providers, clinics, small charities and other small organisations that handle sensitive data, and for the IT providers who support them. In practice the person who books an audit is usually an owner, a practice manager or a registered manager: someone responsible for the answer but without the time to become a security specialist.
Choosing a narrow audience is deliberate. We explain the wider thinking in how we choose what to build next: a product that speaks to one group about one job can be clearer and more useful than a general one.
What does Unavoidably Secure actually do?
It runs independent audits and helps teams close the gaps it finds. The live site sets out the steps:
- A free external audit of a practice’s public web and email presence, with no access to internal systems and a report within five working days.
- A free email check that reads a domain’s public SPF, DKIM and DMARC records and explains them in plain English.
- A full audit made up of 26 automated technical checks and 59 documentation review criteria, covering all ten National Data Guardian standards behind the DSPT and all five Cyber Essentials controls.
- Readiness support that assembles DSPT or Cyber Essentials evidence and supports a team through to submission, followed by a re-test at 60 days.
The output is a written report someone can hand to a partner, an inspector or an IT provider, and a plan to fix what is missing.
Why does Unavoidably Secure not certify anything?
Because certification belongs to the bodies set up to do it, and blurring that line would mislead the people we are trying to help. The homepage says it directly: no assessment certifies compliance with any standard, and Unavoidably Secure is not a Cyber Essentials certification body. Its job is readiness: find the gaps, help close them and get the evidence in order so a submission or certification has the best chance of going through.
Being clear about that also makes the product easier to trust. A practice manager knows exactly what they are buying, and an IT provider knows the audit is there to support their work, not replace it.
How does Unavoidably Secure fit with the rest of the studio?
It is one of several products run by Unavoidable Studio Ltd, alongside Unavoidable CRM and AisleReply. Like the others, it has its own name, website and legal pages, written for its own customers, which we explain in why our products keep separate brands and legal pages. Behind the scenes it uses the same approach to tooling as everything else we run, covered in shared infrastructure across a studio.
The longer-term aim, as the portfolio page puts it, is to automate more of the same checks so a practice’s evidence stays current all year rather than being rebuilt each time a deadline comes round.
FAQs
Is Unavoidably Secure a separate company?
No. Unavoidably Secure is a product of Unavoidable Studio Ltd, company number 17367981, based in Leeds. It has its own website and legal pages, and the company is named on them.
Does the free audit need access to our systems?
No. The free external audit only looks at what is publicly visible, such as your website and email records. The live site says there is no charge, no obligation and no access to your systems.
Can Unavoidably Secure give us a Cyber Essentials certificate?
No. It is not a certification body. It helps you get ready, closes gaps and assembles the evidence, and you then apply for certification through an accredited certification body.
Where can I read more about the DSPT and Cyber Essentials?
The official sources are the DSPT site and the NCSC. The Unavoidably Secure blog explains both in plain English for dental practices, care providers and charities.
To see Unavoidably Secure alongside the other products, visit the portfolio or the Unavoidably Secure portfolio page, read how we validate an idea before we build it, or browse the blog. If you run a practice, care service or charity, you can book the free external audit.
Founder of Unavoidable Studio, a UK venture studio in Leeds building seven software companies at once. Answers his own inbox.