Security
What is built, and what makes each of these true.
This page describes controls that exist in the product today. It does not describe intentions, and it does not describe anything that has not shipped. Each statement below carries, in the page source, a reference to the architectural decision or the build task that implements it — so that a procurement team has something to check rather than something to believe.
Separation and access
The first question is usually whether one customer's data can be reached from another's session, and whether the answer depends on a query being written correctly.
-
A database and an access team for each customer
Each customer organisation has its own database and its own access team, and every collection is granted to that team rather than to signed-in users generally. Separation is a property of where the data lives and who holds the grant, not a filter that each query has to remember to apply.
-
A deployment of your own, where you need one
A customer can be given a complete, independent deployment — its own server, its own database, its own hostname — rather than a partition within a shared one. The same build, the same upgrades, a separate stack.
-
A UK company, with hosting arranged around your requirement
The supplier is a company registered in the United Kingdom. Because a deployment can stand on its own, where your data is hosted is a decision we make with you to fit your policy, rather than a fixed answer you have to accept.
-
The application decides access, and the server enforces it
What a person may see and do is decided by roles and capabilities held centrally, and checked on the server before a change is written. Hiding a control in the browser is not treated as a security measure; a user who should not be able to do something cannot do it by taking another route to it.
-
Encrypted in transit
Every connection to the product and to this website is served over TLS. Certificates are issued and renewed automatically, and the renewal path is part of the operational runbook rather than a manual diary entry.
-
Generated files are granted one at a time
Exported documents and generated reports are stored with a grant on the individual file, naming the company that owns it. There is no store-wide permission that a mistake elsewhere could widen into a cross-customer read.
What the AI can and cannot do
The line between proposing and deciding is the control that matters most to a regulated buyer, so it is worth being precise about where it sits.
-
Nothing an AI produces writes itself
A pass can be set to run when something happens. What it produces is a proposal, and a proposal becomes a requirement only when a named person accepts it. The two are separate paths in the software, and the writing path has no automatic entry.
-
Anything created in bulk is shown first
Whether rows arrive from an AI pass or from a spreadsheet paste, they are displayed individually before anything is created, and there is no shortcut that skips that display. Accepting twelve things yields twelve or none.
-
Every accepted proposal records who accepted it
Because acceptance is a deliberate act by a person, the record shows which person performed it. This is what allows an AI-assisted requirement to be evidenced in the same way as one written by hand.
-
The AI provider is configured for your organisation
Which provider is used is an organisation-level setting rather than something each project chooses. An organisation may use its own provider account, in which case the commercial and data relationship with that provider is directly its own.
What the AI providers say about your content
These are the providers' own published statements rather than ours. Each one links to the source and shows the date we last read it, so you can check it yourself and see how fresh our reading is.
-
Anthropic
"By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models."
Read the provider's own policy — we last checked it on 17 October 2026.
-
OpenAI
"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)." Abuse-monitoring logs are described as retained for up to 30 days by default, or longer where the law requires it.
Read the provider's own policy — we last checked it on 17 October 2026.
-
Google
For paid services: "Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products." The unpaid tier is treated differently, and paid services are what an organisation's configuration uses.
Read the provider's own policy — we last checked it on 17 October 2026.
The record of change
-
Every change keeps what it replaced
Each change to an item is recorded as what it was and what it became, with the person who made it and the time. The history is written on the server as part of the change itself, so it cannot be omitted by a client that chooses not to send it.
-
States are defined, and transitions can be refused
Which states exist and which may follow which is configured per project, and a transition can require a specific capability. The lifecycle your framework mandates is enforced rather than documented.
-
Our sub-processors, listed
Every third party that processes customer data on our behalf is listed with what it does, including any that are being introduced, on a page generated from one maintained list rather than written by hand.
-
How to report a vulnerability
A published contact address for security researchers at the standard location, /.well-known/security.txt, with the expiry date that the convention requires.
Assessment questions
- Can we be given a deployment that is ours alone?
- Yes. A deployment is a complete, independent stack — its own server, its own database, its own hostname — running the same build as every other. Hosting arrangements are agreed with you to fit your policy.
- Is there any configuration in which an AI writes to our data directly?
- No. A pass may be triggered automatically, but its output is a proposal that waits for a person to accept it. Changing that would require a superseding architectural decision and evidence, rather than a setting.
- How is one customer's data kept from another's?
- Each customer organisation has its own database and its own access team, and collections are granted to that team rather than to signed-in users generally. A session holding one company's membership has no grant that reaches another company's database.
- Do you hold our AI provider account?
- You can use your own. Provider configuration is set at organisation level, and where an organisation supplies its own account the relationship with that provider remains directly theirs.
- Will you complete our supplier assessment?
- Yes — send it with your first message and we will answer it against what is built, marking anything that does not yet apply rather than answering it optimistically.
Send the questionnaire first
If you have a supplier security assessment or an AI governance questionnaire, send it before we speak. It is a faster route to a yes or a no than a demonstration.