Security and privacy
Built to hold as little as possible
The safest personal data is the data a system never holds. Our platforms are designed on that basis.
Designed in, not added on
Security and privacy are properties of the architecture rather than a layer applied to a finished system. That ordering matters: a system that was not built to protect something cannot be persuaded to afterwards, only wrapped in policy that describes the gap.
Personal profile data is natively anonymised
Anonymisation happens at the point of capture rather than at the point of export, and personal profile data is never shared. There is no downstream step at which a decision has to be made about whether to protect it: the protected form is the only form the platform holds.
Research uses behaviour, never people
We use platform data to improve and evolve our models. No personal data is used for that purpose. What makes a model better is the shape of how learning and reasoning proceed, not who was doing it, so the useful signal survives anonymisation intact.
One control set, many frameworks
Rather than implementing each regime separately, we maintain a single set of common controls and work to align it with the compliance frameworks and critical controls that apply. Implementing frameworks one at a time produces overlapping evidence and contradictory practice; a common control set produces one answer that can be mapped to each.
What we are not claiming
This page describes how the platforms are built and the controls we operate. It is not a certification claim, and we are not asserting that any particular regulatory standard has been independently attested. Alignment work is ongoing, and we would rather say so than imply a status we cannot currently evidence.
If you are running a procurement or security review and need current detail, whether that is control mappings, data-handling specifics, or where a particular framework sits in our alignment work, ask us. We will answer directly rather than pointing you at a badge.
Ask us directly