Trust centre

• Isolation — every organisation's work is separated at the database level with row-level security, not only in application code.
• Tested, with a stated scope — an automated suite attempts cross-organisation access across selected core records, searches, assistant and agent paths, and files. The most recent dated run completed 94 checks with 0 failures; its detailed scope is available on request.
• Storage in Ireland — the database and file storage are in Ireland (AWS eu-west-1) and encrypted at rest. All traffic is served over TLS.
• AI model processing — may happen outside the EEA; see sub-processors.
• Private files — uploads are stored in private buckets and served only through short-lived signed links.
• No model training — your decision content is not used to train general-purpose models.
• A DPA you can sign — our standard Article 28 terms are published, not negotiated from scratch each time.

Corrections and decision history belong to each organisation's workspace and are never pooled across clients.

Outweigh holds no SOC 2, ISO 27001 or HIPAA certification or attestation, and none is in progress. Decision content is stored as readable text so that the platform can search it, generate councils and write reports; it is protected by isolation, least privilege, access logging and contract — not by cryptography that would make it unreadable to us. If a client requires cryptographic separation from the operator, tell us before signing and we will discuss what is realistic.

Authorised colleagues in one workspace can see shared workspace material. The current isolation report is a vendor-run test of named controls, not a guarantee of zero risk or an independent penetration test.

Security questions and vulnerability reports: rfoley@artellis.ie. Data protection and DPA requests: rfoley@artellis.ie.