Security, privacy, and control boundaries

Every access needs an authenticated sign-in and a controlled session; there is no anonymous access to governance data.

Role-based permissions for Nominated Individuals, Responsible Individuals, Directors, Managers, and inspection access when enabled.

UK data residency: customer data is held in UK data centres (Microsoft Azure UK South).

Encrypted in transit (TLS) and at rest with the encryption our cloud infrastructure providers supply; access is role-restricted and monitored.

Structured operational logging for monitoring and incident response; credentials are managed securely, never in source code.

Every significant action (issue creation, plan approval, review sign-off, inspection lock and unlock) is recorded with its time, its user and the record affected.

Append-only: audit records cannot be edited or deleted. NIs, RIs and Directors can read their own provider's log.

While inspection mode is on, every write for that provider is blocked at the API: nothing can be created, changed or deleted.

Only an authorised user releases the lock; switching it on and off are both in the audit log.

Your data stays yours. Processing is limited to running the platform and contracted service operations.

Never sold, never used for advertising. Request a full export at any time.

Each registered provider in a multi-site deployment is a separate account; one site's data is never reachable from another.

Group views aggregate counts and readiness indicators only, never individual governance records across site boundaries.

Connector ingestion only when your organisation enables it.

No submissions to CQC, Ofsted or other regulators, and no compliance ratings or scores.

AI never makes decisions about your records; its suggestions stay subject to human review. Text sent for AI processing is handled by our AI provider, Anthropic, as set out in the privacy policy.