Trust & Security Centre
Verifiable Security.
Not Security Theatre.
This portal replaces the traditional security questionnaire. Every control listed below is an architectural fact — enforced by the physical topology of our bare-metal infrastructure within UK/EEA data centres, not by policy documents alone.
Regulatory Compliance
Compliance Framework Matrix
Architectural controls mapped against UK GDPR, the Data (Use & Access) Act 2025, Law Society of Scotland practice rules, and ICAS ethical obligations. Filter by framework to review specific regulatory requirements.
18 controls mapped
| Framework | Requirement | Reference | Architectural Control | Status |
|---|---|---|---|---|
| DUAA 2025 | Assessment Notice Mitigation | DUAA 2025, Part 1 | Zero-egress architecture eliminates third-party AI data processing. No data flows exist that would trigger Assessment Notice powers. | Addressed |
| DUAA 2025 | Automated Decision-Making Transparency | DUAA 2025, Part 2 | All model inference occurs on client-controlled bare-metal infrastructure. Full audit trail of prompts and outputs retained within the sovereign perimeter. | Addressed |
| DUAA 2025 | Data Processing Impact Assessment | DUAA 2025, Part 1, Sch. 1 | Self-hosted, network-isolated deployment. No data transmitted externally. Impact assessment scope reduced to internal infrastructure only. | Addressed |
| UK GDPR | Data Processor Obligations | Art. 28 | Your AI runs on a dedicated bare-metal server in a UK or EEA data centre, with no outbound path — so your client data stays on that server and isn't routed to any third party for inference or storage. You contract two processors directly: Private AI Ltd, under a standing DPA, and your infrastructure provider, under your own DPA with it. Private AI Ltd engages no sub-processors of its own. Your infrastructure provider, like any cloud company, uses its own sub-processors for its corporate operations (billing, support, monitoring); these are published in the provider's own sub-processor list, and your DPA with the provider governs them directly. The point is not that no sub-processors exist anywhere — it's that every one is disclosed, and every processing relationship is one you've signed and can audit. Nothing is hidden behind the scenes. | Addressed |
| UK GDPR | Standing Processor — Zero Standing Privileges | Art. 4(8) | Private AI Ltd acts as a Standing Data Processor under Article 4(8) UK GDPR. The standing DPA is operative continuously from signature. In the Default Operating State, Private AI Ltd holds no active connection, no credentials, and no means of accessing Client systems. Active processing is limited to authorised JIT Support Sessions and Professional Services Engagements governed by Schedule 2 of the standing DPA. | Addressed |
| UK GDPR | International Data Transfers | Art. 44–49 | Zero data egress. All data resides on bare-metal servers in UK/EEA data centres (London/Helsinki). No transfer mechanism required as data never leaves the perimeter. | Addressed |
| UK GDPR | Data Protection by Design | Art. 25 | Privacy enforced architecturally via Zero-Egress Routing and Zero Standing Privileges. Data protection is a physical constraint, not a policy control. | Addressed |
| Law Society of Scotland | Client Confidentiality | Law Society of Scotland Practice Rules 2011, Section B, Rule B1.6 (Confidentiality) | Network-isolated inference environment secured via self-hosted sovereign access layer. Client data never transmitted to external providers. Confidentiality maintained by zero-egress network topology. | Addressed |
| Law Society of Scotland | Professional Independence | Law Society of Scotland Practice Rules 2011, Section B, Rule B1.3 (Independence) | Client firm retains full administrative control. Zero Standing Privileges model ensures no vendor dependency on infrastructure access. | Addressed |
| Law Society of Scotland | Technology Risk Management | Obligations under Rule B1 (Standards of Conduct) and Law Society of Scotland Cybersecurity Guidance | Bare-metal deployment in UK/EEA data centres. No containerisation, dedicated CPU and GPU, no external APIs. Full auditability of all system components. | Addressed |
| ICAS | Data Security & Client Confidentiality | Code of Ethics, S. 140 | Zero-egress perimeter with network-layer enforcement. Client financial data and PII processed exclusively within the sovereign boundary. | Addressed |
| ICAS | Third-Party Service Provider Due Diligence | Code of Ethics, S. 300 | No third-party AI service provider sits in the data path. The client contracts each processor directly and can review each processor's terms — including any subcontracting rights — before signing. The supply chain is short and fully visible, not eliminated by claim. | Addressed |
| ICAS | Anti-Money Laundering Data Handling | MLR 2017, Reg. 21 | KYC and client onboarding data processed within Zero Standing Privileges environment. JIT access controls with full cryptographic audit trail. | Addressed |
| EU AI Act | Extraterritorial Scope — UK Firms with EU Operations | EU AI Act (Reg. 2024/1689), Art. 2 | Where the client's AI system produces outputs used within the EU (EU clients, EU-facing work, EEA-based personnel), the Act applies regardless of UK domicile. Sovereign deployment on EEA-based infrastructure (Helsinki) places the inference and storage layer within EU jurisdiction, supporting demonstrable territorial alignment for affected workloads. | Addressed |
| EU AI Act | AI Literacy Obligations | EU AI Act, Art. 4 (applicable from 2 February 2025) | Deployers are required to ensure sufficient AI literacy among staff using or overseeing AI systems. Private AI Ltd provides deployment documentation, user guides, and onboarding materials enabling the client to satisfy internal AI literacy requirements for the sovereign platform. Consumer AI tools used without governance cannot demonstrate literacy compliance; a documented, governed deployment can. | Addressed |
| EU AI Act | Prohibited AI Practices | EU AI Act, Art. 5 (applicable from 2 February 2025) | The sovereign platform deploys open-weight general-purpose LLMs under client control. No prohibited practices (subliminal manipulation, social scoring, real-time biometric surveillance) are architecturally possible within the zero-egress, client-governed deployment. The client controls model selection, system prompts, and permitted use cases entirely within their own infrastructure perimeter. | Addressed |
| EU AI Act | GPAI Model Transparency and Documentation | EU AI Act, Art. 53–55, Chapter V (applicable from 2 August 2025) | The platform deploys open-weight models whose providers publish technical documentation, model cards, training data summaries, and usage policies in satisfaction of GPAI transparency obligations. Unlike closed API services, the client has full visibility of the model deployed, its version, and its configuration. Model weights are static on client infrastructure — no ongoing telemetry or training occurs. | Addressed |
| EU AI Act | High-Risk AI — Human Oversight and Audit Trail | EU AI Act, Art. 9, 12, 14, 26 (Annex III deployer obligations; full application 2 August 2026) | For clients whose AI use falls within Annex III high-risk categories (e.g. AI used in administration of justice, employment decisions, or access to essential services), the sovereign architecture produces the audit trail, logging, and human oversight artefacts the Act requires as a side-effect of normal operation. Prompt logs, inference records, access logs, and RBAC configuration are retained within the client's own infrastructure. Zero-egress architecture ensures these records cannot be accessed over any external network path. Deployer obligations under Art. 26 — including human oversight, monitoring, and incident logging — are structurally supported by the platform's design. | Addressed |
DUAA 2025Addressed
Assessment Notice MitigationDUAA 2025, Part 1Zero-egress architecture eliminates third-party AI data processing. No data flows exist that would trigger Assessment Notice powers.DUAA 2025Addressed
Automated Decision-Making TransparencyDUAA 2025, Part 2All model inference occurs on client-controlled bare-metal infrastructure. Full audit trail of prompts and outputs retained within the sovereign perimeter.DUAA 2025Addressed
Data Processing Impact AssessmentDUAA 2025, Part 1, Sch. 1Self-hosted, network-isolated deployment. No data transmitted externally. Impact assessment scope reduced to internal infrastructure only.UK GDPRAddressed
Data Processor ObligationsArt. 28Your AI runs on a dedicated bare-metal server in a UK or EEA data centre, with no outbound path — so your client data stays on that server and isn't routed to any third party for inference or storage. You contract two processors directly: Private AI Ltd, under a standing DPA, and your infrastructure provider, under your own DPA with it. Private AI Ltd engages no sub-processors of its own. Your infrastructure provider, like any cloud company, uses its own sub-processors for its corporate operations (billing, support, monitoring); these are published in the provider's own sub-processor list, and your DPA with the provider governs them directly. The point is not that no sub-processors exist anywhere — it's that every one is disclosed, and every processing relationship is one you've signed and can audit. Nothing is hidden behind the scenes.UK GDPRAddressed
Standing Processor — Zero Standing PrivilegesArt. 4(8)Private AI Ltd acts as a Standing Data Processor under Article 4(8) UK GDPR. The standing DPA is operative continuously from signature. In the Default Operating State, Private AI Ltd holds no active connection, no credentials, and no means of accessing Client systems. Active processing is limited to authorised JIT Support Sessions and Professional Services Engagements governed by Schedule 2 of the standing DPA.UK GDPRAddressed
International Data TransfersArt. 44–49Zero data egress. All data resides on bare-metal servers in UK/EEA data centres (London/Helsinki). No transfer mechanism required as data never leaves the perimeter.UK GDPRAddressed
Data Protection by DesignArt. 25Privacy enforced architecturally via Zero-Egress Routing and Zero Standing Privileges. Data protection is a physical constraint, not a policy control.Law Society of ScotlandAddressed
Client ConfidentialityLaw Society of Scotland Practice Rules 2011, Section B, Rule B1.6 (Confidentiality)Network-isolated inference environment secured via self-hosted sovereign access layer. Client data never transmitted to external providers. Confidentiality maintained by zero-egress network topology.Law Society of ScotlandAddressed
Professional IndependenceLaw Society of Scotland Practice Rules 2011, Section B, Rule B1.3 (Independence)Client firm retains full administrative control. Zero Standing Privileges model ensures no vendor dependency on infrastructure access.Law Society of ScotlandAddressed
Technology Risk ManagementObligations under Rule B1 (Standards of Conduct) and Law Society of Scotland Cybersecurity GuidanceBare-metal deployment in UK/EEA data centres. No containerisation, dedicated CPU and GPU, no external APIs. Full auditability of all system components.ICASAddressed
Data Security & Client ConfidentialityCode of Ethics, S. 140Zero-egress perimeter with network-layer enforcement. Client financial data and PII processed exclusively within the sovereign boundary.ICASAddressed
Third-Party Service Provider Due DiligenceCode of Ethics, S. 300No third-party AI service provider sits in the data path. The client contracts each processor directly and can review each processor's terms — including any subcontracting rights — before signing. The supply chain is short and fully visible, not eliminated by claim.ICASAddressed
Anti-Money Laundering Data HandlingMLR 2017, Reg. 21KYC and client onboarding data processed within Zero Standing Privileges environment. JIT access controls with full cryptographic audit trail.EU AI ActAddressed
Extraterritorial Scope — UK Firms with EU OperationsEU AI Act (Reg. 2024/1689), Art. 2Where the client's AI system produces outputs used within the EU (EU clients, EU-facing work, EEA-based personnel), the Act applies regardless of UK domicile. Sovereign deployment on EEA-based infrastructure (Helsinki) places the inference and storage layer within EU jurisdiction, supporting demonstrable territorial alignment for affected workloads.EU AI ActAddressed
AI Literacy ObligationsEU AI Act, Art. 4 (applicable from 2 February 2025)Deployers are required to ensure sufficient AI literacy among staff using or overseeing AI systems. Private AI Ltd provides deployment documentation, user guides, and onboarding materials enabling the client to satisfy internal AI literacy requirements for the sovereign platform. Consumer AI tools used without governance cannot demonstrate literacy compliance; a documented, governed deployment can.EU AI ActAddressed
Prohibited AI PracticesEU AI Act, Art. 5 (applicable from 2 February 2025)The sovereign platform deploys open-weight general-purpose LLMs under client control. No prohibited practices (subliminal manipulation, social scoring, real-time biometric surveillance) are architecturally possible within the zero-egress, client-governed deployment. The client controls model selection, system prompts, and permitted use cases entirely within their own infrastructure perimeter.EU AI ActAddressed
GPAI Model Transparency and DocumentationEU AI Act, Art. 53–55, Chapter V (applicable from 2 August 2025)The platform deploys open-weight models whose providers publish technical documentation, model cards, training data summaries, and usage policies in satisfaction of GPAI transparency obligations. Unlike closed API services, the client has full visibility of the model deployed, its version, and its configuration. Model weights are static on client infrastructure — no ongoing telemetry or training occurs.EU AI ActAddressed
High-Risk AI — Human Oversight and Audit TrailEU AI Act, Art. 9, 12, 14, 26 (Annex III deployer obligations; full application 2 August 2026)For clients whose AI use falls within Annex III high-risk categories (e.g. AI used in administration of justice, employment decisions, or access to essential services), the sovereign architecture produces the audit trail, logging, and human oversight artefacts the Act requires as a side-effect of normal operation. Prompt logs, inference records, access logs, and RBAC configuration are retained within the client's own infrastructure. Zero-egress architecture ensures these records cannot be accessed over any external network path. Deployer obligations under Art. 26 — including human oversight, monitoring, and incident logging — are structurally supported by the platform's design.Security Artefacts
Document Vault
Audit reports, certifications, and technical specifications are available under mutual NDA. Select any document below to initiate the access request process.
Jurisdictional Defence
UK GDPR &
Jurisdictional Defence
Private AI Ltd acts as a Standing Data Processor under Article 4(8) UK GDPR (Company No. SC881079), operating under a Zero Standing Privileges architecture. The standing Data Processing Agreement is operative continuously from signature. In the Default Operating State, Private AI Ltd holds no active connection, no credentials, and no means of accessing Client systems. For infrastructure hosting, clients execute direct agreements and DPAs with our certified infrastructure partners, ensuring a fully transparent and auditable supply chain. No third-party authentication, access gateway, or network transit provider in the access path.
Data at rest is strictly confined to UK/EEA data centres (London/Helsinki), satisfying UK GDPR data residency requirements. Zero-Egress Routing, encrypted reverse proxy tunnel, and Zero Standing Privilege access controls provide defence-in-depth that satisfies Article 32 (Security of Processing). Your Article 28 obligations are met through direct DPAs with each infrastructure partner — no opaque sub-processing chains, no hidden fourth parties.
Require Further Technical Disclosure?
We'll give your technical and compliance people full architectural transparency — network topology, access control specifications, and jurisdictional documentation.
Talk to our team