The security summary your IT team asked for.
A short, plain-English summary of how we host, secure, segregate and audit our products. Anything more detailed - policies, penetration-test summaries, data-flow diagrams - is provided under NDA on request.
/ 01
Encryption
TLS in transit, at-rest encryption for stored data, and key management aligned with industry practice.
/ 02
Access control
MFA, role-based access control with named permissions, and lifecycle management (activate, deactivate, retain history).
/ 03
Data segregation
Access segregated by organisation, team and user. Customer data is never used to train public, general-purpose or cross-customer AI models, and is not shared across tenants. Where a customer opts in, models can be tuned on that customer's own data for that customer's exclusive use, within their environment and under contractually agreed scope.
/ 04
Testing & monitoring
Independent third-party penetration testing on a regular cadence, application-level monitoring, and a web application firewall in front of user-facing services.
/ 05
UK product hosting
Better Outcomes is hosted on UK infrastructure, with data residency configurable per customer where required. Our marketing website is hosted separately and does not process customer or product data.
/ 06
Audit history
Every action - who did what, when and from where - is written to a detailed, append-only audit history across Better Outcomes.
/ 07
Single sign-on (SSO)
Available now for customers who manage access through their own identity provider.
/ 08
Bias monitoring
AI evaluations are monitored for bias across agent, team and customer groups, with findings reviewed under our AI governance process.
How we deploy, integrate and govern the AI.
Deployment model
Single-tenant or segregated multi-tenant deployment on UK infrastructure, scoped and configured with each customer. Data scope, retention and integrations are agreed in writing before go-live.
Integration capability
Telephony and recording platforms, CRM and case-management systems, chat and email channels connected through supported integrations and secure file transfer. Connected scope is defined per deployment.
AI governance
Configurable outcome frameworks, explainable reasoning with source evidence, confidence levels, human review and override, versioned models and scorecards, and reporting for risk and compliance oversight.
Data protection
UK GDPR and DPA 2018 controller and processor responsibilities set out contractually. Data minimisation applied to vulnerability information: operational need, not diagnosis.
Working with organisations focused on better customer outcomes
- LuvCars
- Money Wellness
- Think Money Limited
- Ocean Finance
We are working towards ISO/IEC 27001 certification and a SOC 2 attestation, both expected in January 2027. These are listed here as held only once awarded. Policies, penetration-test summaries and data-flow diagrams are available under NDA.
Point your IT-security team here first.
Have your team send us their questionnaire. We normally return a completed response within one working week, and can arrange a structured technical session with our engineering team on request.