Trust, security and responsible AI

• Closed knowledge system
  AI assistants are restricted to using approved, pre-defined council content and documentation only.
• No training on user data
  Resident interactions are not used to train AI models.
• Human-in-the-loop oversight
  Safeguarding, escalation and review processes are built into the platform.
• Controlled AI behaviour
  AI is constrained to information provision and guidance – not autonomous decision-making.
• Transparency by design
  Clear explanations of what the AI can and cannot do.

• Secure cloud hosting environment
• Role-based access control (RBAC)
• Regular patching and security updates
• Monitoring and alerting for abnormal behaviour
• Incident response processes in place
• Regular security reviews and vulnerability testing

Cyber Essentials Plus

We are Cyber Essentials Plus certified, providing independent assurance that our security controls have been externally tested and verified.

Cyber Essentials Plus goes beyond self-assessment and includes hands-on technical validation by an accredited assessor. This demonstrates that we have effective controls in place to protect systems and data against common cyber threats.

Cyber Essentials Plus provides assurance that we:

• Protect against common attack vectors
• Maintain secure system configuration
• Control and restrict access to data and services
• Apply effective patching and malware protection
• Have security controls that have been independently tested

This level of certification is widely recognised and trusted across UK public-sector organisations.

ISO/IEC 27001:2022

We are certified to ISO/IEC 27001:2022, the international standard for information security management systems, certified by Citation ISO Certification Limited.

The scope of our certification covers the provision of technical consultancy and development for web-based solutions, including AI-driven digital assistants, to public and private sector organisations.

ISO/IEC 27001 provides independent assurance that we:

• Systematically identify and manage information security risks
• Maintain robust access control, encryption and data handling practices
• Operate a continual improvement cycle for our security management system
• Are independently audited on an ongoing basis to retain certification
• This certification underpins the technical and organisational measures described elsewhere on this page.

ISO/IEC 42001:2023

We are certified to ISO/IEC 42001, the international standard for AI Management Systems.

This certification demonstrates that we have formal governance in place for the responsible development, deployment and operation of AI systems, including:

• AI risk assessment and mitigation
• Human oversight and accountability
• Transparency and explainability
• Ongoing monitoring and continuous improvement

ISO/IEC 42001 provides independent assurance that AI risks are actively managed — particularly important for public-sector use cases.

ISO 9001

We operate a Quality Management System aligned with ISO 9001.

This ensures that our internal processes support:

• Consistent service delivery
• Clear documentation and accountability
• Continuous improvement
• Customer and stakeholder focus

ISO 9001 underpins how we design, deliver and support our platform for public-sector clients.