Data, security & technical approach
Security and privacy are considered alongside the software itself. We define the information, permissions and operational controls for each project, then test them against the way the system will be used.
Discuss your requirementsWe identify which sources the solution needs, how they are connected and what information should remain out of scope. Your business data remains yours.
Approved source lists, retrieval configuration and scoped system credentials define the information available to each task.
Different people and AI clients may need different tools and information. We configure permissions around their responsibilities and the work they are authorised to do.
Authentication, role-based access and tool permissions are implemented for the project. Read and write access are assessed separately.
We agree which steps can run automatically, which need validation and which require a person to approve. Incomplete requests and failures need a defined route for review.
The AI Control Layer exposes approved capabilities. Workflow rules and validation are applied around tool use; untrusted content must not grant new authority.
Hosting, processing, retention and export requirements are discussed and documented. Connected services are considered as part of that design.
ChatFox’s published hosting approach is UK-based for application data it hosts. Processing by connected services is assessed separately; project-specific arrangements define where information is handled.
We test realistic tasks and relevant failure cases with your team. Monitoring and audit requirements are agreed so important activity can be reviewed.
Checks can cover tool access, data validation, unexpected inputs, failed integrations and approval paths. Audit records and monitoring are configured for the agreed scope.
We agree support responsibilities, maintenance and how changes will be reviewed as your business develops.
Connections, permissions, knowledge sources and application behaviour may need updating over time. Change review and support arrangements form part of delivery.
We draw on information-security and AI-governance control principles when designing our solutions. This is not a claim of ISO 27001 or ISO 42001 certification.
Get in touch
You don’t need a technical specification. Tell us about the process, problem or opportunity, and we’ll help define the right solution.
