CRM and Automation Delivery for Regulated Firms
Regulated sector CRM delivery, done inside an FCA-regulated investment manager, an NHS-adjacent healthcare staffing platform, and a multi-business-unit insurance group, by a senior engineer working directly in the client’s own stack, not a specification handed to a separate delivery team.
What Changes in a Regulated Build
The mechanics of a HubSpot or Salesforce build don’t change for a regulated client; the standard of evidence around every decision does. A pipeline stage change, an automated email, a permission grant, all need to be attributable and reconstructable after the fact, not just functional on the day they were built.
Consumer Duty evidence trails
The FCA’s Consumer Duty requires firms to evidence good outcomes for customers, not just claim them. Where a client’s own compliance function has Consumer Duty in scope, that means workflow logic and communication history need to be traceable: which automated message went to which customer, when, and why, not reconstructed from memory after a regulator asks. That’s a requirement built for, not a certification held; no engagement in the delivery record below is presented as a Consumer Duty deliverable.
Access control
Who can see which records is a design decision made at the data model stage, not a permission set copied from a template. The role-based access layer built for an NHS-adjacent healthcare platform (the Secondary Care Cockpit, covered in the Delivery Record below), with session invalidation so a password reset or a role change actually revokes existing sessions rather than leaving them valid until they expire naturally, is the standard this is built to.
Data residency for self-hosted n8n
Where automation touches personal data, self-hosted n8n keeps every credential and every execution log inside infrastructure you control, rather than a third-party processor’s. See n8n Consultancy for the self-hosted versus cloud decision in full.
Audit logs and change history
A workflow that can’t show what it did, and why, isn’t audit-ready no matter how well it works. The change history a build like this produces as a byproduct of normal operation is produced by exactly the kind of technical control a Data Protection Impact Assessment needs to document as a mitigation, not a separate exercise assembled after the fact.
The Delivery Record
Every Deal Gets a Defined Path, and Compliance Gets a Paper Trail
A full HubSpot implementation: a six-stage deal pipeline with exit criteria, 13 automation workflows, and three operational dashboards, one built specifically for compliance oversight showing the audit-relevant view rather than making a compliance officer reverse-engineer it from the commercial dashboard.
3D Estate Visibility With a Permission Layer Built for 71 Trusts
The Secondary Care Cockpit: a 3D geographic view covering all 71 mapped NHS trusts, with live two-way HubSpot sync and a standalone, KV-backed permission layer built specifically for the tool: passwords hashed with scrypt, account lockout after repeated failed attempts, and session-version invalidation so a password reset or a role change revokes existing sessions rather than leaving them valid until they expire naturally. That permission store holds login credentials for the Cockpit itself, scoped and agreed with the client as part of the build; the underlying deal and contact data it displays lives in the client’s own HubSpot instance, which the Cockpit reads from and writes back to.
One Preference Centre, Every Business Unit
A unified HubSpot preference centre resolving years of independently evolved, inconsistently structured consent records across a group grown by acquisition, so the group has one answer to what a contact has actually agreed to, not as many answers as there are business units. No single locked metric attached to this build; the outcome is qualitative, and stated as such rather than dressed up as a number.
How Equanax Works With Compliance
A regulated build doesn’t happen in isolation from a client’s compliance function; it happens alongside it. Design decisions on data model, access control and audit logging get reviewed with whoever owns compliance risk on the client’s side before they ship, not presented as a fait accompli afterwards. That’s slower than building in isolation and shipping, which is the point: a compliance function that finds out about a change after it’s live cannot do its job. The same model applies here as everywhere else: the engineer who has the conversation with compliance is the same one who builds the result, so nothing gets lost in translation between a compliance requirement and its technical implementation. This is also how ongoing HubSpot administration works for a regulated client once the initial build ships: the same person who shipped the access control layer is the one who maintains it, rather than a handover to a generalist support desk.
What Audit-Ready Regulated Sector CRM Delivery Means
“Audit-ready” gets used loosely enough in this market that it’s worth defining plainly. It doesn’t mean a checklist was completed once at go-live. It means access control, data residency for self-hosted automation and audit logging are structural properties of the build itself, still true a year after launch without anyone having to remember to maintain them, with Consumer Duty evidence trails added to that list wherever a client’s own compliance function has Consumer Duty in scope. An audit-ready CRM in the UK regulated sector is one where a compliance officer can answer “who changed this, and why” without asking an engineer to go and check, because the answer was already captured at the moment the change happened.
Frequently Asked Questions
Is Equanax ISO 27001 certified?
No. Equanax does not hold ISO 27001 or any other formal information security certification, and states that plainly rather than implying otherwise. What’s checkable instead: a live HubSpot Solutions Directory listing, a public Companies House record, and a delivery record of three regulated-sector builds you can read in full before engaging.
Where does client data sit during an engagement?
Inside the client’s own HubSpot or Salesforce instance, and inside self-hosted n8n infrastructure the client controls when automation is part of the build. Where a build includes its own bespoke tool, such as the Secondary Care Cockpit’s permission layer, that tool’s supporting infrastructure is scoped and agreed with the client as part of the build; it holds what the tool itself needs to run, not a shadow copy of the client’s CRM records.
Are there sub-processors involved in a regulated engagement?
Where automation touches a third-party tool, such as Clay for enrichment or Apollo for prospecting, that tool is a sub-processor of the client’s data under the client’s own agreement with it, not Equanax’s. Which tools are in scope, and under whose agreement, gets confirmed during the audit before any build starts, so there are no surprises once work is underway.
How do I check Equanax myself?
Equanax is UK company number 13194418, incorporated 10 February 2021, trading from 86-90 Paul Street, London, EC2A 4NE. Director: Jack Alexander Crabtree. A public record, checkable in a minute on the Companies House register. Equanax also holds a live listing on the HubSpot Solutions Directory as a Sales Ops and RevOps Partner.
Start With a Free Audit
A working session on your CRM, scoped to your stack. Tell us if you’re in a regulated sector and the audit will reflect it.