Privacy by Design
Privacy considerations are part of product design, not an afterthought. We limit what we collect, restrict who can access it and prefer references over raw personal data wherever possible.
Security by Design
Threat modelling, code review and secure defaults are built into our development lifecycle. Security features (RLS, RBAC, MFA-capable auth) are always-on rather than opt-in add-ons.
Least Privilege Access
Roles grant only the permissions required to perform a task. Sensitive operations require elevated roles and are logged.
Auditability
Institutions can review what happened, when and by whom, through built-in audit logs. Platform-wide audit trails are available to the super-admin audit centre.
Transparency
We publish plain-language policies, a security whitepaper, a live status page and a responsible disclosure programme.
Data Minimisation
We store the minimum information required to verify credentials, protect the service and meet legal obligations.
Responsible AI
- AI outputs are advisory; institutional records remain authoritative.
- Every AI decision is logged for auditability.
- We do not use customer or citizen data to train third-party foundation models.
Secure Development Lifecycle
- Code review before merge.
- Automated dependency and security scanning.
- Staging environments and controlled release process.
- Post-incident reviews to improve controls.
Roadmap
We are actively evaluating alignment with recognised frameworks and expect to publish concrete milestones as they are achieved. This page will be updated when we do.