Security & availability
Public-sector assurance, designed in.
UK data residency, Cyber Essentials, role-based access, audit and a 99.9% availability commitment with a 24/7 support model.
- UK South
- CE / CE+
- 99.9% target
- 24/7 support
Commitments
What we commit to.
These are design commitments, not claims of measured production performance.
-
UK South
Data residency
Data and backups remain in the UK. Any transfer outside the UK triggers a transfer risk assessment and TfGM approval.
-
CE today
Cyber Essentials
Cyber Essentials Plus is committed before contract commencement; penetration and resilience testing are mobilisation milestones.
-
99.9%
Availability
Approximately 43 minutes of downtime in 30 days, measured against the agreed service boundary and exclusions.
-
24/7
Support
Named primary and secondary contacts, severity-based triage, documented escalation and post-incident review.
-
Role-based
Access control
Operator, supervisor, analyst and administrator capabilities, with MFA and session controls.
-
Append-only
Auditability
Every operational action records actor, time and before/after values. Corrections are new entries.
-
Your key
Model access
BYOK: an administrator supplies the OpenAI, Anthropic or OpenAI-compatible key. Keys are encrypted, masked and never exported.
-
Redacted
AI data flow
AI context is allowlisted and redacted; outputs are advisory, audited and never change status or publish an alert.
Questions
The questions evaluators ask.
Where is the data stored?
Production data and backups are held in Microsoft Azure UK South. Sub-processors are documented, contracted under Article 28 terms and reviewed annually.
What happens during an incident?
Severity-based triage with named primary and secondary contacts, documented escalation to application specialists and Azure support, and a post-incident review.
Can we export our data?
Yes. The canonical model exports to JSON, CSV and GeoJSON from the console, and the contracts that describe it are published with the product.
Is the AI-assisted capability using a live model?
Detection remains deterministic and rules-based. AI assistance is an optional advisory layer using a customer-supplied (BYOK) OpenAI, Anthropic or OpenAI-compatible key. It drafts explanations, briefs, alerts and reviews; a human accepts or edits every output and the approval gate is unchanged.
Do you train on our data?
No. The platform does not train or fine-tune models on TfGM data. Prompts are redacted, stored only as a hash plus a limited excerpt, and sent to the provider selected by the authority under its own terms and DPA.