Trust & Security
Trust and security, stated plainly
What we can confirm today, and what we don’t have confirmed detail to share on yet.
What we can confirm
Built and hosted in the EU
We are built and hosted in the EU. Beyond that one fact, the detail enterprise buyers usually ask for next — exactly where data lives, which sub-processors are involved, and whether we hold any independent certifications — isn’t ready for us to publish yet. Rather than guess, here is exactly what’s still pending.
Controlled AI usage
How the AI itself is kept under control
Hosting answers where your data sits. This answers the question an enterprise asks straight afterwards: what stops the model inventing something that then gets funded.
Standardised prompts
The model is not improvised against per request. The prompts behind each step are defined, versioned and reused, so two identical requests are treated identically.
Monitoring and output validation
Output is checked rather than trusted on sight — so what reaches a reviewer is a draft that has already been tested against the shape it is supposed to have.
Professional review before it counts
Every generated business case and requirements package is reviewed by the people accountable for it. The platform prepares the evidence; it does not approve anything.
Innovation with professional review and control — not automation nobody signed off.
Still to confirm
What we’ll publish here once it’s confirmed
These are the areas an enterprise buyer or regulator typically expects a Trust & Security page to answer. We don’t have a confirmed answer for any of them yet, so each is marked as pending rather than guessed at.
Data location & hosting
Exactly where customer data is stored and processed. We don’t have this confirmed to share yet.
Sub-processors
Which third parties, if any, are involved in processing customer data. We don’t have this confirmed to share yet.
Certifications & compliance
Whether we hold any independent certifications or audits. We don’t have this confirmed to share yet.
Encryption
How data is protected in transit and at rest. We don’t have this confirmed to share yet.
Data retention & deletion
How long data is kept, and how a deletion request is handled. We don’t have this confirmed to share yet.
Incident notification & DPA
How customers would be notified of a security incident, and whether a signed data processing agreement is available today. We don’t have this confirmed to share yet.
If you need answers to any of this for a live evaluation, contact us directly and we will work through it with you rather than pointing you back at this page. Get in touch →
Start with one real demand.
We start with a focused discovery session and a short demonstration using one of your real demands.