The controls behind the platform.

Request access and tell us your name, company and which documents you need. We send our standard mutual NDA for e-signature, or use the one already in place with your company. Access is granted within two business days, usually the same day.

Our audit reports and policies describe how we secure our systems in detail. That detail is useful to a customer assessing us and equally useful to an attacker, so we share it under a mutual NDA rather than publishing it openly.

Yes. Send it to we@holisticai.com. Reviewing our SOC 2 report and ISO 27001 documentation first will usually answer most of it.

The information security management system supporting the development and deployment of the Holistic AI platform, covering our Engineering, IT, HR, Admin, Customer Support, Sales and Marketing functions. A certification is only as meaningful as its scope, so the full scope statement and Statement of Applicability are both available under NDA.

Certification runs on a three-year cycle with annual surveillance audits by our certification body in between, and we run our own internal ISMS audit and management review at least annually. Certification is a point in time; the surveillance cycle is what keeps it honest.

Annually, by an independent third party. The executive summary is available under NDA — request it alongside our audit reports.

Not yet. Our ISO/IEC 42001 certification audit is scheduled for the coming months and we will update this page when it completes. We would rather tell you where we actually are than imply a certificate we do not hold.

Email we@holisticai.com with enough detail for us to reproduce it. We acknowledge every report and keep you updated until it is resolved. Please do not access data that is not yours, and do not degrade the service for others while testing.

No. We do not use customer data to train models.

We do not build or train models of our own. The Holistic AI platform assesses and governs the AI systems our customers build or buy — it does not learn from the data it handles. Your data is used only to run the service for you.

Within 72 hours of a confirmed incident affecting your data, or within the timeline agreed in your MSA if that is shorter. Notification runs under our Incident Management Procedure and Personal Data Breach Notification Policy.

By default, in the UK — Amazon Web Services, Europe (London). US customers are hosted in the United States: AWS US East (Ohio), or Google Cloud Platform where required. Data is replicated across multiple regions for redundancy and disaster recovery.

Yes. A standard Data Processing Agreement template exists, including international transfer safeguards, available on request.

Holistic AI Limited is the data controller where customers provide personal data directly through the Website. In such circumstances, the Information Commissioner’s Office (ICO) is our supervisory authority.

Where we enter into an MSA with a customer, Holistic AI Limited acts as a data processor and processes personal data solely on the customer’s documented instructions, in accordance with the applicable data protection provisions in the MSA and, where required, a Data Processing Agreement (DPA). Our processing activities are therefore undertaken in accordance with the UK GDPR and the Data Protection Act 2018, as applicable to our role as either controller or processor.

Data is retained only as long as necessary for the purpose it was collected for, or according to the timeline set out in your MSA. Deletion is initiated on termination or on your request; your data is then permanently removed from storage, databases and backups using our secure deletion protocols. Written confirmation of deletion is available on request.