Discovery inputs
Describe the workflow and share redacted examples. Avoid passwords, API keys, private customer records or regulated data in the public enquiry form.
Buyer security review
Set the data boundaries before connecting the systems.
Security requirements depend on the product, information and operating environment. Use this review guide to define the controls your engagement needs. It describes decisions to agree, rather than a certification, audit attestation or guarantee of compliance.
Start safely
Use anonymised context for the first conversation.
Access by agreement
Identify who needs access, why it is required and when it should expire. Discuss client-controlled accounts and permissions before connecting production environments.
Define the boundaries
Ask specific questions about the proposed architecture.
| Decision | Evidence to agree | Owner to identify |
|---|---|---|
| Hosting & regions | Environment owner, provider, region, backups and recovery expectations | Client infrastructure owner |
| AI & subprocessors | What leaves your systems, model/provider terms and whether external processing is permitted | Data owner and technical team |
| Access & secrets | Roles, privileged actions, key storage, rotation and access removal | Security and environment owners |
| Retention & logs | Which records are stored, what logs contain and deletion responsibilities | Data and support owners |
| Security incidents | Contact route, escalation, investigation access and contractual notification requirements | Named contacts on both teams |
Evaluate
Test restrictions as carefully as the happy path.
Permission checks
Demonstrate that one user cannot retrieve another user’s restricted records. Review administrative privileges and exposed exports.
AI-specific failure paths
Agree handling for unsupported answers, malicious instructions in source content, sensitive output and human review. Test with representative examples and document limitations.
Dependency & deployment review
Discuss dependency checks, environment configuration, release approvals and rollback. Define who performs any independent penetration test and how findings are handled.
Contractual fit
Confirm requirements with the responsible specialists.
If your procurement process requires a DPA, BAA, data-residency commitment, independent audit, certification or sector-specific control, raise it before sharing sensitive information or commissioning the build. Availability and contractual suitability must be confirmed for the particular engagement.
Review the scope and issuer
Review our published company certificate documents and confirm the named organisation, scope, dates and issuing body with your procurement team. A certificate for one standard does not establish that every other security or contractual requirement is covered.
Website privacy
The website privacy policy explains enquiry data handling. Project data processing, retention and subprocessors need their own agreed terms.
Before you decide
Questions to resolve together
Can we send production data with an enquiry?
Use anonymised examples first. Establish data-sharing terms and an approved transfer route with the team before sharing sensitive or regulated information.
Can the product run in our cloud account?
Discuss your account, region, access model and deployment restrictions. The architecture and delivery scope must confirm what is feasible before a commitment is made.
Does this page prove regulatory compliance?
No. Requirements must be assessed for the specific organisation, data and deployment. Request the evidence and contractual commitments your security and legal reviewers need.
An informed next step
Bring your workflow. Define the right first release.
Share the problem, existing systems and the decision you want to improve. Use anonymised examples first. We can discuss scope, ownership and the evidence needed before committing to delivery.