The confidence
enterprise demands.

How we protect your data, the standards we hold ourselves to, and who helps us run the service.

01 At a glance

At a glance

  • Your data never trains AI models

  • Encrypted throughout

  • 72-hour incident notice

  • Your data, kept separate

02 Standards

Standards and certifications

  • CSA AI Pledge badge

    CSA AI Pledge

    Responsible AI commitment

  • CSA STAR for AI Level 1 badge

    CSA STAR for AI

    AI security assurance

  • CSA STAR Level 1 badge

    CSA STAR

    Cloud security assurance

  • OpenChain ISO/IEC 5230 conformance badge

    ISO/IEC 5230

    Open-source licence compliance

  • OpenChain ISO/IEC 18974 conformance badge

    ISO/IEC 18974

    Open-source security assurance

03 Data and AI

Data and AI

How we use your data

  • Customer data is processed in the region set out in your agreement.
  • Retention: conversation records are kept on a rolling 24 months, or for less if you choose. Security and audit logs are kept for 12 months. After an account closes, you can export your data for 30 days, and it is then deleted or returned within a further 30 days.

How we use AI

  • Answers come only from your own business data.
  • Model providers are contractually barred from training on your data, and zero-retention processing is used where providers offer it.
  • Our incident response plan covers AI-specific incidents.

04 Security

Security controls

  • Encryption in transit and at rest
  • Least-privilege access with multi-factor authentication for admin staff
  • Logical separation of customer data
  • Logging of access and admin actions
  • Change, vulnerability and patch management
  • Staff screening and training
  • Tested backups and restoration
  • Secure disposal of data
  • Assessment of sub-processors before we use them

05 Sub-processors

Sub-processors

Sub-processors, purposes and categories
ProviderPurposeCategory
MetaBusiness messaging services (WhatsApp, Instagram, Messenger)Messaging
TwilioMessaging and voiceMessaging
Microsoft AzureAI model inferenceAI
Alibaba CloudAI model inferenceAI
Microsoft AzureData hosting and storageData
Google CloudData hosting and storageData
AWSData hosting and storageData

Some providers apply only to bespoke implementations. Your agreement sets out which apply to you.

We give 30 days’ notice before engaging a new sub-processor. Full details, including processing country, are available in the Console or on request.

06 Partners

Partners and integrations

Meta

Bletchley is a registered Meta Tech Provider.

Enterprise system integrations

IBM, SAP.

07 Documents

Documents

Privacy policyData Processing AgreementCookie policyTermsSecurity documents

Questions about security or privacy?
Write to info@bletchley.cc.