AS TRUE TODAY · 29 SEPTEMBER 2026
Security.
What happens to your data, what’s in place today, and what isn’t yet. We’d rather show you the gaps than have you find them.
Your data, start to finish
You send
Only the fields the work needs, through a link you control with access that expires. Never by email. Card details, ID numbers, dates of birth, and dietary, access or religious details stay out, and are deleted automatically if they arrive anyway.
We hold
In one encrypted container for your business alone, on an encrypted machine. Never synced to cloud storage, never in backups or code.
AI sees
Only scrubbed text with a reference number: no names, emails, phone numbers or addresses. We send back IDs and reasons; your own system turns IDs back into names.
Who else
The AI provider named in your agreement, under its business terms, and nobody else. At Expanza, only Finley. Never another client.
We delete
Raw exports within 7 days of building the working copy. Everything within 30 days of the end, or sooner if you ask, with a dated certificate.
If something goes wrong
A phone call and a written note within 24 hours of us finding out, so you can meet your own 72-hour duty to report.
What’s in place
6 of 12 in place. No client data moves until every line is done and the agreement is signed.
| Control | Where it stands | Status |
|---|---|---|
| Registered with the Information Commissioner’s Office | ZC133315 | In place |
| Full-disk encryption on the machine that holds client data | In place | In place |
| One encrypted container per client (AES-256), outside code repositories and backups | Built and tested, 28 of 28 checks | In place |
| Personal details removed before any AI step | Tested: 0 leaks on 5,543 planted items | In place |
| Deletion with a signed certificate | Tested end to end on a throwaway container | In place |
| Written incident plan | Written; tell you within 24 hours | In place |
| Data processing agreement | Drafted; solicitor review not yet done | Not yet |
| Incident drill on a fake client | Not yet run | Not yet |
| AI provider account on business terms, one workspace per client | Not yet set up | Not yet |
| Account hardening checklist (multi-factor sign-in everywhere, least privilege) | Not complete | Not yet |
| Cyber Essentials certification | Not started | Not yet |
| Professional indemnity and cyber insurance | Not yet bought | Not yet |
AI providers
The AI step uses Anthropic’s Claude through its business API. Anthropic processes that text mainly in the US, under UK-approved contract terms. No provider offers UK-only AI processing today. We never use free or personal AI chat apps with client data. We re-check the provider’s terms at source before every agreement, and name them in it.
Questions
Whoever looks after IT or data at your business can ask for the one-page data note and the draft agreement: finley@expanza.co.uk. For this website’s own protections and accessibility, see website security and accessibility.