Cyber Essentials certified. Hosted in UK data centres. Quarterly internal penetration testing. Your data stays where it should, under your control and protected by real security measures.
Certifications
We don't just say we're secure. We prove it with recognised certifications.
Government-backed certification for cyber security. Passed, not pending. We meet the baseline for protecting against common cyber attacks.
Built for UK and EU data protection requirements. Data processing agreements, subject access requests, and right to deletion built in.
Data Protection
Your data is hosted in UK data centres (AWS London) and stored under UK data law. Where you use the AI features, the AI provider (OpenAI or Anthropic) processes the text they send it.
All data encrypted when stored. AES-256 encryption. Even if someone accessed the physical storage, your data would be unreadable.
TLS 1.2+ for all connections. Your data is encrypted between your browser and our servers. No exceptions.
Control who sees what. Granular permissions by role, team, or individual. Users only access what they need.
100+ event types logged. Every login, every change, every access. Full trail of who did what and when. Exportable for compliance.
API keys with granular permissions. Rate limiting. IP allowlisting available. Secure integration without exposing your system.
Access Control
Granular permissions. Multi-factor authentication. IP restrictions. You decide who gets in.
Optional 2FA for all users. TOTP-based. Add an extra layer of security to every login.
Lock an analytics API key to the IP addresses you name, so only your own systems can use it.
Sessions expire on their own. Microsoft single sign-on is available for firms that want sign-in run by their own IT.
Each customer's data is logically isolated. No cross-tenant data access. Your data is yours alone.
Screenshots
Each person's access is a set of switches written in plain English, with a summary of what they can do and which roles are locked.
The sun and moon switch a screen between light and dark, and a click opens it full size.
See all 77 screens in the product tourLeast privilege in practice
“Granular permissions” is what every vendor says. Here is the actual mechanism, in the order it runs, so you can judge whether it covers the confidentiality your operation has to hold. Each layer can deny on its own.
Role
Roles bundle capabilities, from standard user through team leader to internal admin, alongside granular roles for specific powers such as managing file tags or approving permission requests. A role is granted by a named administrator and the grant is logged.
Workflow
Visibility is set per team member, per workflow, and down to individual statuses within a workflow. Someone handling intake can be shown the first three stages of a process and nothing beyond them.
Product
A task type can be marked restricted, which means holding a role is no longer enough. Access then depends on having an active assignment on the case itself. Allow rules form a whitelist by case relationship, and a deny rule always wins over an allow.
Case
Case relationships decide what a person sees on the case in front of them. The same user can be case owner on one, an expert on another, and hold no relationship at all to a third, which is what makes note and form visibility workable without maintaining lists by hand.
Field
Forms, actions and notes each declare which user types can see them, and visibility rules can hide content until named questions are answered. Files carry their own permissions, separate from the documents they relate to.
A restricted task type can also be kept out of listings entirely, configured independently of who may open it. Cases that should not advertise their existence do not appear in a count, a search result or a report for anyone without access.
Users request a role rather than being handed one informally. The request sits pending until a permissions manager grants or denies it, and the request, the decision and the person who made it are all recorded for the access review you will eventually be asked for.
Audit Trail
Every action logged. Every change recorded. When auditors ask what happened, you have the answer. Exportable reports for compliance reviews.
What we promise you.
Your data is yours. We don't sell it, share it, or use it for anything except running your system.
If something goes wrong, you'll know. We disclose security incidents promptly and clearly.
Ongoing security assessments. We don't set and forget. We continuously improve.
Security questions answered by real people in the UK. Not outsourced, not scripted.
Data Processing
Full transparency on data processing, sub-processors, and data flows. Everything your DPO needs to complete a vendor assessment.
We provide a comprehensive DPA covering GDPR Article 28 requirements. Includes data processing purposes, categories of data subjects, security measures, and sub-processor obligations.
Available on request before contract signingWe use a limited number of sub-processors. Our primary infrastructure runs in UK data centres. The AI features use OpenAI or Anthropic, which process the text they are sent. We notify customers before adding any new sub-processor.
Current sub-processor list available on requestComplete data export in standard formats whenever you want it. When the contract ends, your data is deleted after a reasonable retention period, as our terms set out.
Deletion terms covered in the DPAExport your data at any time in CSV, JSON, or XML formats. No vendor lock-in. Your data is yours and you can take it with you.
Self-service export from your reportsCompliance Journey
Achieved Cyber Essentials certification, the UK government-backed scheme for cyber security. Renewed annually since.
Full GDPR compliance programme including DPA templates, DSAR handling, and data protection impact assessments.
Need to complete a vendor security assessment? We answer standard and bespoke security questionnaires, and send the documents that back them up.
We're happy to discuss our security measures, provide documentation for your compliance team, or answer specific questions about how we protect your data.
