Security and data handling

Every organisation has its own workspace. Decisions, evidence, uploaded material, councils and decision records are scoped to that organisation and enforced at the database level with row-level security policies — not only in application code. A consultant working across several clients sees each client's work separately.

Isolation is covered by an automated test suite that attempts cross-organisation access across selected core records, searches, assistant and agent paths, and files. The latest dated run completed 94 checks with no failures; its precise scope is available on request.

Authorised colleagues in the same workspace can see shared workspace material. Roles restrict sensitive actions and records; this is separate from the boundary between different customer organisations.

Access requires an authenticated session. Sign-in is available by email and by Google. Every server call is authorised against the signed-in user's identity; ownership is derived from the verified session, never from values supplied by the browser.

Files you upload are stored in private buckets with no public access. They are served only through short-lived signed links issued to a user who is authorised for that organisation.

All traffic is served over TLS. The database and file storage are stored in Ireland (AWS eu-west-1) and encrypted at rest by the underlying infrastructure provider.

When a council, brief, report or answer is generated, content may be processed outside the EEA — see sub-processors for where it goes.

The in-product assistant can only read data belonging to the organisation the signed-in user is currently working in. It cannot query another organisation's decisions, evidence or records.

Decision content, briefs, evidence and notes are stored as readable text so the platform can search them and generate outputs from them. Personnel with infrastructure credentials are technically capable of reading that content. The protections against this are least privilege, logged administrator access the customer's own owner can see, confidentiality obligations and our data processing agreement — not encryption that would make the content unreadable to us. We hold no SOC 2, ISO 27001 or HIPAA certification and none is in progress. The current isolation evidence is vendor-run and is not an independent penetration test or a guarantee of zero risk.

Every third party that processes customer data is named, with its purpose and location, on our sub-processors page. Your decision content is not used to train general-purpose models.

Our pre-answered security questionnaire and data processing agreement are published, and the dated isolation test report is available on request. Everything is collected in the trust centre.

If you believe you have found a security issue, email rfoley@artellis.ie with enough detail to reproduce it. We will acknowledge within three working days. Please do not disclose publicly before we have had a chance to respond.