Company · Trust Centre
Trust Centre
Where your data is held, how we protect it, and the documents a vendor review needs, in one place.
- Data held in
- UK and EU
- Every environment, production, testing and support alike.
- Certifications
- ISO/IEC 27001In Progress
- ISO/IEC 42001In Progress
- Cyber Essentials PlusIn Progress
- Final audit 20 November 2026
- Last updated
- 11 October 2026
- Ask us for anything not here.
Documents
For Your Vendor Review
Open to everyone, on request
- Data processing agreementSubprocessors listed in its annex.On request: ask us for a copy Data processing agreement
- Subprocessor listOn request: ask us for a copy Subprocessor list
- Security questionnaireCSA STAR Level 1, CAIQ v4.On request: ask us for a copy Security questionnaire
- Security overviewOn request: ask us for a copy Security overview
- PoliciesOn request: ask us for a copy Policies
- Accessibility statementThe standard we build to, what we know falls short, and how to tell us.On request: ask us for a copy Accessibility statement
Under NDA, on request
Our penetration test summary, and anything else confidential, once a non-disclosure agreement is in place.
Ask for theseWhere data is held
EU/UK Sovereign
All customer services are held in the EU and UK. Your data is stored and processed there in every environment, production, testing and support alike.
As a UK-domiciled vendor hosting in the UK or EU, we carry materially lower exposure to the US CLOUD Act than US-headquartered alternatives, because the Act follows provider control, not data location.
How we protect it
The Commitments Underneath the Platform
- Residency
UK or EU data residency
Customer data is processed and stored in the UK or EU, including the model endpoints used for retrieval and analysis.
- Encryption
Encrypted in transit and at rest
Transport encryption everywhere, encryption at rest for stored data, with managed keys.
- Access
Least privilege
Role-scoped access, short-lived credentials, and audit logging on the systems that hold customer data.
- Integrity
Tamper-evident evidence
The cryptographic spine records governance actions as a verifiable, tamper-evident chain, so a produced record can be trusted.
- Subprocessors
Vetted and listed
A short, reviewed set of subprocessors, chosen for regional processing and available to customers on request.
- Resilience
Backups and recovery
Regular backups and tested recovery, so the record survives failure without losing its chain of custody.
AI use
AI Transparency
We are transparent about where we use AI and where we use our own intellectual property. AI is one of the tools we use, but it never replaces decades of regulatory judgement. Our AI Use Disclosure sets out where each applies.
Accessibility
Built to WCAG 2.2 AA
Our accessibility statement: the standard we build to, what we know falls short, and how to tell us.
Registrations
Who We Are
- Company
- Standard Intelligence Ltd, registered in England and Wales, company number 16737890
- Registered office
- 128 City Road, London EC1V 2NX
- Data protection
- ICO registration number ZC263412
Responsible disclosure
Found Something? Tell Us.
If you believe you've found a vulnerability, report it to us before disclosing it publicly. We'll acknowledge your report, keep you updated while we investigate, and we won't pursue action against research conducted in good faith under a coordinated-disclosure approach.
Report a vulnerabilityThis page is a summary, not a contractual commitment.
Your next step