Every claim here carries an honest status
Nothing on this page is asserted as settled fact unless it is confirmed. Where something is still in progress, on request, or simply not yet built, that's exactly what it says.
Claims on this page
- Claims listed
- 36
- Confirmed today
- 22
- Groups covered
- 5
In short: client operational data stays in the accounts and systems agreed for that engagement. Website enquiries follow the separate KV, CRM and notification path disclosed below. Every automated action has a named person checking anything sensitive before it goes anywhere, and every claim carries an honest status.
A vague reassurance about “AI safety” isn’t worth anything on its own, so every item below carries a status (confirmed, in progress, on request, planned, or not applicable), rendered by the same component throughout, so a claim that isn’t true yet is never shown as if it were.
Thirty-six items are grouped into five sections: how data and infrastructure are owned, the technical controls in place, the compliance and legal mechanics, who else touches an enquiry, and the registrations and insurance still to come. Where a status reads planned or in_progress, that reflects the company’s actual stage right now, not a gap being hidden.
The statuses on this page are the verifiable half of a broader set of commitments — freedom to leave, cost discipline, resilience by design — set out in plain words on the client protection page.
Every claim, with its actual status
Data & infrastructure ownership
Client account ownership Confirmed
Client-specific subscriptions and integrations run in the client's own accounts, never ours.
Human-in-the-loop on every workflow Confirmed
Every automated workflow has a defined escalation and review point.
Client-hosted automation infrastructure Confirmed
The automation itself runs on infrastructure the client controls, not ours.
Vendor swappability by design Confirmed
No workflow is architected around a single provider.
Client-controlled AI model choice Confirmed
Where a model is used, the client picks the provider and tier on their own account.
Data minimisation by design Confirmed
Systems are built to hold only what a workflow actually needs.
Your accounts, subscriptions and API keys stay in your name Confirmed
Every platform account, subscription and API key created for an engagement is created in the client's own name throughout, never ours.
Referral or reseller commission disclosed before any recommendation Confirmed
Any referral or reseller income from a recommended vendor is disclosed before the recommendation is made, not after.
At least two options compared before recommending one Confirmed
Every vendor-selection decision compares more than one suitable option and documents why the others weren't chosen.
Website enquiry storage and retention In progress
Accepted enquiries are stored in Workers KV before CRM and notification delivery. Automatic expiry is not yet implemented.
Technical security controls
Encryption in transit Confirmed
All traffic to this site and its edge functions runs over TLS.
Encryption at rest Planned
Applies to data held in systems we operate directly.
Two-factor authentication and access control Confirmed
Applies to every account we hold on a client's or our own behalf.
Backup strategy Confirmed
Covers code, content and any operational data we hold.
Incident response plan Planned
Covers breach notification timelines and escalation.
Limited staff access Confirmed
Access to a client's systems is limited to those directly delivering that engagement.
Audit logging Confirmed
Every automated send, approval and escalation is logged with who approved it.
Cookieless analytics Confirmed
No visitor tracking to consent to, and no cookie banner as a result.
Graceful degradation, never silent failure Confirmed
Every workflow has a defined fallback if a system it depends on goes down.
Data protection & compliance
Enquiry and workflow retention controls In progress
Workflow periods are defined per engagement; automatic expiry for the website enquiry store is still a pre-launch requirement.
DPIA screening on every project Confirmed
Completed in full wherever health data, profiling or automated decisions are involved.
Article 22A automated-decision assessment Confirmed
Assessed under UK GDPR for every workflow that could touch a significant decision.
Sub-processor register In progress
A vendor-by-vendor record of who sees what data, and on what terms.
International transfer mechanisms In progress
Vendor-by-vendor transfer mapping is in progress, including the globally replicated website-enquiry KV path.
AI disclosure policy Confirmed
Any automated voice or chat interaction discloses that it is automated.
Client engagement hosting in EU/UK regions by default Confirmed
This is the default architecture for client operational workflows. Website-enquiry storage is described separately.
External legal review of templates Planned
Covers governance and legal document templates used across engagements.
Written scope and change control Confirmed
Every project carries a written scope; only the existing appointment-business catalogue uses the published day rate.
Sub-processors in the enquiry path
Cloudflare (hosting, Pages Functions, Workers KV) Confirmed
Serves the site, runs the form endpoint, and holds the durable record of each enquiry. Processed on Cloudflare's edge network.
HubSpot (CRM) In progress
Holds the contact record created from a submitted form: name, business, sector and what you told us about the problem.
Resend (transactional email) Planned
Intended for enquiry confirmation emails. Not in use yet: no confirmation email is sent today.
Registrations & insurance
ICO registration Planned
Registration deliberately deferred until the company itself is registered.
Cyber Essentials certification Planned
Professional indemnity insurance Planned
Cyber insurance Planned
Data Processing Agreement available on request In progress
Template DPA in preparation; legal review still pending.