Security

How we handle your data

This page is written for the reader looking for a reason to say no. Every claim below is checkable; ask us to evidence any of them.

Scope

We agree scope in writing before touching anything. A data processing agreement is in place before any data moves.
Access is the minimum the workflow needs. Extensions to scope are agreed in writing, never assumed.

Your data

Your data stays yours. We do not train models on it.
Model providers are engaged under data processing agreements. UK and EU hosting options are available.
On exit, your knowledge base, prompts and pipelines transfer to you. We delete what we hold and confirm it in writing.

Access

Access is named, scoped, logged and revocable.
Where your firm already has a permissioning model, agents work inside it. They reason only over what the requesting user is entitled to see.

Audit

Every output keeps its trail: sources, prompts, model version, reviewer. The trail is available to you throughout the engagement.
Human sign-off gates are configured per workflow and cannot be removed silently.

Suppliers and incidents

A current subprocessor list is available on request. Changes are notified before they take effect.
We notify you of any incident affecting your data without undue delay.

Questions

We answer security questionnaires directly. We claim no certification we do not hold, and if a control is not in place we say so and give you the date it will be.

Vulnerability reports: see /.well-known/security.txt · Contact: hello@tacit.ltd

Start

Bring us one workflow

Pick the one that eats your Tuesdays. We'll map it, show you what the agent version looks like, and tell you honestly if it isn't worth building.

Book a workflow review Or write: hello@tacit.ltd