Compliance
Last updated: 6 November 2026
Compliance is built into how we set up and run every client environment. It is part of the pipeline that deploys your agents, not a project that starts when an audit comes.
How it works
- When you join, you tell us which rules apply to you. You can skip this and decide later.
- Each rule is a switch in your environment’s configuration.
- Switching one on applies the matching controls everywhere: where data is hosted, how long it is kept, who can access it, what agents may do and what is logged.
- Controls are checked continuously, and the evidence is collected as they run.
- Every change goes through the same reviewed pipeline as your agents, so it is recorded.
Always on
- A separate AWS account for each client, hosted in the EU unless you choose otherwise.
- Encryption at rest and in transit, with keys dedicated to your company.
- Sign-in through your company’s identity provider, and least-privilege access for agents.
- A log of every action an agent takes.
- Personal data removed from agent traces.
- No training of AI models on your data.
- Tests that must pass before any change to an agent goes live.
- A clear notice when people interact with an agent.
Compliance profiles
| Profile | What it switches on |
|---|---|
| GDPR | Hosting in the EU, a record of processing, requests from individuals to access, export or delete their data, retention limits, a 72-hour breach response and a data processing agreement. |
| UK GDPR | Hosting in the UK or the EU, the same rights and records as GDPR, and UK transfer terms. |
| EU AI Act | Logs of agent decisions, human approval before decisions about people, and technical documentation built from your test sets. |
| US state privacy laws | Requests to know, delete, correct and opt out, service-provider terms, and hosting in the US. |
| HIPAA, on request | A business associate agreement, eligible services only, and longer log retention. |
| DORA, on request | The contract terms DORA requires of ICT providers to financial firms, support for incident reporting, an exit plan and audit rights. |
Where your data lives
Your environment runs in the region you choose: the EU, the UK or the US. Moving data between regions is a migration, so we ask this when you join.
What a profile does and does not do
A profile configures technical and organisational controls in the environment we run for you, and gives you the evidence. It supports your compliance, but it does not make you compliant on its own and it is not legal advice. Your legal team decides which rules apply to you, and we tell you plainly what each profile covers and what stays with you.
Our infrastructure
We run on Amazon Web Services. AWS’s certifications and audit reports, including ISO 27001 and SOC 2, cover the underlying infrastructure.
Questions
To discuss a specific regulation, email us.