Security and data

Your salaries, bank statements and unpublished ideas are sensitive. This is how the product is designed to protect them. It describes the design and is not a guarantee.

Where your data lives

Each organisation chooses where its data and AI processing live: the UK or the EU at first.
A UK location comes first, with an EU location in place before the first EU customer.

Who can see what

Each organisation has its own hostname, users, settings and encryption key, and tenant scope is enforced on every access.
A consortium project spans organisations only through explicit membership.
Partners do not see each other's rates or costs.

Our own access

Digital Tactics also applies for grants, so its staff have no access to customer data by default.
A customer can grant time-limited access. Every action under it is logged and visible to that customer, and the access ends on expiry.

How AI uses your data

Customer data is never used across tenants or for training.
Personal data and secrets are checked for before any call to a model.
By default, AI and consortium partners see only the redacted copy of a sensitive document, such as a bank statement.

Evidence files

Uploads pass malware and file-type checks before anything can be downloaded.
Redaction removes the hidden text and metadata as well as what is on the page, and the output is re-checked. The original stays under restricted access.
Whether funders and accountants accept redacted statements is still an open question, so ask yours.

Certification and contracts

We claim no security certification for this product.
A penetration test, contract terms and a sub-processor list are all required before customer data goes in.
This page is not a contract and gives no legal advice.