Security that fits regulated operations.
We build for environments where traceability and control matter. We start with your constraints, then choose the right deployment approach.
How we think about security
We answer security questionnaires before we talk about price.
Traceability
Outputs are explainable. Responsibilities link back to source text so reviewers can validate them.
Least privilege
Access is role-based. Sensitive documents and outputs are scoped to the right users.
Controlled change
Changes are reviewable. Outputs that drive decisions go through a named approver.
Deployment and data handling
We support options that keep data isolated and auditable.
- Cloud-hosted or private deployment
- You define what data is ingested, stored, and retained
- Authentication through your identity provider
- Audit logs exportable for your assurance team
- Runs inside your Microsoft 365 boundary, reading from the document systems you already use
Work with your security team
- We will complete your security questionnaire
- We can provide a security brief under NDA
- We design to ISO 27001, SOC 2 and NIST CSF control families
If you need a specific deployment model, tell us. We will not sell you the wrong one.
Data protection and GDPR
We are registered with the Information Commissioner's Office as a data controller for our own corporate data, and act as a data processor when handling client information as part of service delivery.
How we handle your data
- Each client runs in a separate environment with dedicated databases and search indexes
- Hosted on Clairvynt's UK Azure infrastructure, or deployable on your own ring-fenced infrastructure for products that support it
- Client authentication uses your own Microsoft Entra ID
- Data encrypted at rest and in transit
- Client documents and data are never used to train shared or public models
Compliance and certification
- Registered with the ICO (UK data protection regulator)
- UK GDPR compliant as a data processor
- EU clients: the UK adequacy decision means no additional transfer mechanisms are required for UK-EU data flows
- Cyber Essentials certified
- Cyber Essentials Plus assessment in progress
Full detail is in our privacy policy and sub-processor register.
Let's talk
We help energy and renewables teams produce structured, traceable output for document-heavy work. Share your use case and we'll outline if and how we can help.