Security & Trust

If you're evaluating Integrated AIS as part of a security review, vendor due diligence process, or procurement questionnaire, this page sets out how we approach data protection and secure deployment. It is written for CISOs, information security teams, and procurement — if something you need isn't covered here, our team can provide further detail directly.

Data protection posture

Our approach to data protection is built around encryption, least privilege, and minimising what we hold — applied consistently across every engagement, not tailored on a case-by-case basis.

Encryption in transit and at rest

Data exchanged between your systems and any Integrated AIS-managed infrastructure is encrypted in transit using current TLS standards. Data at rest — including any client data processed or stored as part of a deployment — is encrypted using industry-standard algorithms, with encryption keys managed and rotated separately from the data they protect.

Access controls and least privilege

Access to client environments, systems, and data is granted on a least-privilege, need-to-know basis and reviewed on a regular schedule. Every account is individually attributable — we do not use shared logins — and multi-factor authentication is required for any administrative or privileged access. Access is revoked as soon as a team member's role changes or their involvement in an engagement ends.

Segregation and data minimisation

Client data, models, and configurations are kept logically separate between engagements. We agree data handling, storage, and retention terms with every client before any data is processed, and we collect and retain only what is required to deliver the agreed scope of work.

Monitoring and incident response

We maintain logging and monitoring proportionate to the sensitivity of each deployment, and operate a documented incident response process so that any suspected security event is identified, contained, and communicated to affected clients without unnecessary delay.

Secure & on-premises / air-gapped deployment

For regulated industries and sovereign or defence-adjacent organisations, the greatest AI risk is rarely the model itself — it's the data path around it. Where a client's requirements call for it, we design and deploy AI systems entirely within the client's own infrastructure, with no dependency on external APIs or third-party cloud inference.

In a fully air-gapped deployment, models, data, and inference all run inside a network boundary with no connection to the public internet, so data cannot leave the environment even in principle. This matters most where data sovereignty, classification requirements, or contractual confidentiality make any external data path unacceptable, regardless of how well that path is secured.

Secure and on-premises deployment is a core part of how we design systems from the outset, not an option applied afterwards to something built on public cloud infrastructure. We work within a client's existing security architecture, hardware, and approval processes, rather than asking them to adopt new infrastructure to accommodate us.

Certifications & assurance

We are pursuing independent verification of the practices described above through a structured, continuous certification programme rather than a one-off exercise — assessments are actively underway and we are progressing them until each is achieved. Each certification below will be linked to supporting evidence — certificates, audit reports, or assessment summaries — before it is referenced anywhere else on this site.

ISO 27001 (in progress)

Information security management systems.

ISO/IEC 42001 (in progress)

AI management systems.

Cyber Essentials (in progress)

UK government-backed cyber hygiene baseline.

None of the above should be read as a current claim of certification. This section will be updated, with evidence linked, before it is relied upon by any client, partner, or procurement process.

Responsible disclosure

If you believe you have found a security vulnerability in this website or in any system operated by Integrated AIS, we want to hear from you. Please report it to us privately via ourcontact form before disclosing it publicly, and give us a reasonable opportunity to investigate and remediate. We will acknowledge legitimate reports, keep you updated on our progress, and will not pursue action against researchers who act in good faith, avoid privacy violations and service disruption, and do not access or modify data beyond what is necessary to demonstrate the issue.

Our machine-readable security contact is published at/.well-known/security.txt(RFC 9116).

Need more detail for your risk assessment?

If you're running a vendor security review, due diligence process, or procurement questionnaire, our team can provide architecture diagrams, data flow documentation, and direct answers to your specific questions.

Contact our team about security