Trust, security and your data
Training records, signed standards and incident evidence are sensitive. This page sets out plainly where your data lives, who can see it, what we can prove, and what we have not yet certified.
Data residency
Your records and documents are stored in the United Kingdom and European Union, with daily backups. Backups are held in the same region as the live data.
Access control
Access is role-based. Colleagues see only their own training record. Managers see their own site. Organisation administrators see their own organisation and nothing belonging to another customer. Roles are checked on the server on every request, so they cannot be changed from a browser.
Audit trail and exports
Every document revision, approval, training completion, routine card sign-off and administrative change is written to an append-only audit trail with the person, the time and the change. Auditors can be handed a single export covering a chosen date range.
Data ownership and export
Your data remains yours. You can export people, training records, documents, routine evidence and audit logs at any time as CSV, PDF or JSON, without asking us and without a fee. If you leave, you can take a full export before the workspace is closed.
Sub-processors
Third parties involved in running the service.
| Service | Purpose | Region |
|---|---|---|
| Application and database hosting | Runs the service and stores your records and documents | UK / EU |
| Transactional email delivery | Sends routine evidence, alert and invitation emails | EU |
Security certifications
We hold no security certifications yet and we will not imply otherwise. The controls described on this page are in place today; independent certification is not. We will publish each award here, with its date, as it is achieved.
How lapse-risk prediction and compliance intelligence work
TODO: confirm with owner. Draft: the analysis reads only your own organisation's records: training completions and renewal cycles, role requirements, routine card adherence, document review dates and logged incidents. It does not use other customers' data. TODO: confirm with owner. Draft: lapse-risk prediction is rules-based, using renewal cycles and adherence history. Compliance intelligence is assisted by an automated language model that drafts summaries and suggested revisions from those same records. TODO: confirm with owner. Draft: nothing is applied automatically. A named approver in your organisation must review and approve every document revision and corrective action before it takes effect.
Reporting a security concern
Email info@aesupplychainconsultancy.co.uk with the words "security" in the subject line. We aim to acknowledge within one working day and will tell you directly if any incident affects your data.