Control is built into every decision.

Encryption approach, key management and configuration are part of the platform's security architecture. Detailed architecture and control information is available during the security review.

Access is based on role, workspace and workflow responsibility, and workspace boundaries are enforced so a user assigned to one project cannot see evidence, findings or records from another.

Material outputs remain connected to the source evidence behind them. The rules applied, findings raised, reviews performed and approvals given can remain visible alongside the output, and human reviewers retain responsibility for material judgment — nothing material is treated as final without that trail attached.

Customer data is used to operate Inversiq and, where authorised, to evaluate and improve customer-specific models, rules and workflows within that customer's scoped environment. Customer data and learning signals are not pooled across customers or used to improve models for other organisations. Any use for shared model training requires explicit agreement, and external AI providers may only process data under approved contractual and technical controls.

Exact hosting, access and retention requirements are agreed for the customer environment during implementation.

Retention, export and deletion requirements are agreed contractually, and handling follows the customer environment and applicable requirements at the time.

Each material event — an approval, override or resolved finding — records the actor, the action, the evidence involved, the permission outcome, the reviewer and the resulting state, so rationale stays visible in the decision record rather than only the final outcome.

Yes. Inversiq is designed to connect with existing identity, document and workflow systems rather than requiring a full replacement. Specific integrations are configured per deployment.

Model-provider selection and configuration are assessed as part of the platform architecture. Specific providers and data-use terms are documented during implementation and available during the security review.

Architecture documentation, current assurance status and applicable control information are shared during the security review, alongside the implementation and deployment requirements relevant to procurement.