Clear trust information for responsible data and AI engagements.

It gives prospective clients and review teams a central place to understand our approach to security, privacy, confidentiality, responsible AI, resilience, quality, third-party dependencies, and due diligence. It is not a substitute for project-specific contractual or technical review.

No. Data consulting engagements vary by scope, platform, data category, client environment, access model, geography, and delivery method. Applicable practices and responsibilities should be confirmed during scoping and documented in the relevant agreement or project plan.

No certification or audit status is claimed on this page. Where approved evidence exists, it should be listed in the Trust Documents area. Procurement and security teams may request available documentation for review, subject to confidentiality and access restrictions.

We can review reasonable questionnaires and supplier-assessment requests. Completion depends on relevance, available verified evidence, confidentiality requirements, scope, and the time needed to coordinate accurate responses with the appropriate owners.

Confidentiality terms, including an NDA where appropriate, can be discussed before sensitive information is exchanged. Final terms are subject to legal review, the nature of the engagement, jurisdiction, and the responsibilities of each party.

A DPA may be appropriate where the engagement involves processing personal data on a client’s behalf. Roles, instructions, data categories, purposes, subprocessors, transfers, retention, deletion, and security measures must be reviewed for the specific engagement.

Our approach is to seek only the access reasonably required for the agreed work, define authorised users and environments, and align access methods with client requirements where practical. Exact controls depend on the client platform, delivery model, and approved technical configuration.

Confidential information should be identified, shared through approved channels, limited to authorised participants, and used only for the agreed purpose. Handling, return, deletion, and retention requirements should be captured in applicable contracts and project procedures.

AI use should be purposeful, proportionate, reviewed by people, and aligned with client instructions. Whether an AI tool is appropriate depends on data sensitivity, contractual restrictions, model behaviour, transparency needs, intellectual-property considerations, and the required level of human review.

No. Models, forecasts, dashboards, reports, and automated decisions can be affected by source quality, assumptions, drift, missing context, configuration, and user interpretation. Validation criteria, human review, limitations, and acceptance responsibilities should be agreed for each engagement.

Suspected events should be escalated, assessed, contained where possible, documented, and communicated according to applicable procedures and contractual requirements. Exact notification duties, contacts, and timelines must be defined and approved for the engagement.

Third-party dependencies may be reviewed for purpose, data exposure, access, location, contractual terms, service criticality, and client restrictions. The client may also retain responsibilities for approving platforms, accounts, licences, configurations, and vendor terms.

Depending on availability and approval, requests may include policy summaries, completed questionnaires, data-flow information, architecture notes, incident-process summaries, business-continuity information, privacy details, or contractual documentation. Some materials may require an NDA or controlled access.

Retention and deletion should be based on project needs, legal and contractual obligations, technical feasibility, backup dependencies, and client instructions. Engagement-specific requirements should be agreed rather than inferred from a general website statement.

Use the Contact Trust Team page or the main contact route and identify the review type, project, deadline, requested materials, and relevant stakeholders. This helps route the request to the appropriate legal, privacy, security, technical, or delivery owner.