Controls you can read, not badges you have to take on trust.
Here is what happens to your data and your work, step by step. Each control is written into the engagement, so you can read it, review it and hold us to it.
Every job takes the same road.
A written procedure at the start, a second person before anything with external consequences leaves the team, and a record at the end.
- Request receivedLogged against the written procedure for that work.
- Procedure appliedWorked by the named team member, in your systems.
- Second-person checkAnything with external consequences is reviewed by a second person.
- DeliveredHanded back in the format you already use.
- ReportedCounted in the weekly report and reviewed monthly.
Work in your systems, under your rules.
We work in your systems under your access policy. Where regulation or contract requires, data stays in your environment or a region you choose and we operate through your virtual desktop or approved tooling. Finished work passes a second person before it returns.
AI does the routine. People stay accountable.
Five rules that apply wherever AI is part of an engagement. Anything specific to your work, including the AI tools used and how they handle your data, is agreed with you in writing first.
People own the outcome
A named team lead is accountable for every function, whether or not AI is involved. AI supports the team; it does not replace accountability.
Routine only, within rules you approve
AI handles routine, low-risk volume inside rules agreed with you. Complaints, refunds, exceptions, payments and anything sensitive go to a trained person.
Sampled and reviewed
AI output is sampled and reviewed by the team, and anything with external consequences passes a second person before it leaves.
A human is always reachable
Your customers can always reach a person. AI is never the only way to get an answer.
Your data, your policy
AI tools run under your access policy. Where regulation or contract requires, data stays in your environment or a region you choose. The AI tools used for your engagement, and how they handle your data, are agreed with you in writing before work starts.
The controls we operate, stated plainly.
Rather than badges, here is what actually happens to your data and your work. Each of these is written into the engagement, so you can review it and hold us to it.
Confidentiality by default
Every team member signs confidentiality undertakings before onboarding. Client work is discussed only with people assigned to it.
Least-privilege access
We work in your systems under your access policy. Accounts are named, scoped to the role, reviewed periodically and removed the day an assignment ends.
Controlled workstations
Client work runs on managed devices with disk encryption, endpoint protection, restricted removable media and no local storage of client data where the engagement requires it.
Data residency options
Where regulation or contract requires, data stays in your environment or in a region you choose; we operate through your virtual desktop or approved tooling.
Two-person integrity
Payments, customer-facing messages, published content and any other work with external consequences pass a second person before they leave the team. Errors are logged, categorised and fixed at root cause.
Continuity planning
Documented procedures, cross-trained cover and redundant connectivity mean a single absence, outage or device failure does not stop your work.
We describe controls rather than claim certifications. Formal certification status will be published here when a certificate is held.