Question 1

Where is data hosted, and can we choose the region?

Accepted Answer

The platform runs on managed cloud infrastructure with distributed databases. Hosting region and data residency are agreed per engagement, including jurisdiction-specific deployment where a federation or regulator requires it. We confirm the exact regions and the suppliers behind them in writing during procurement.

Question 2

How is one organisation's data separated from another's?

Accepted Answer

Isolation is enforced at the database row through security policies tied to organisation and role, in addition to checks in the application. An administrator cannot query outside their own organisation even if the application asks the database to. Learning records, reports, cases and knowledge collections are all scoped the same way.

Question 3

How is data encrypted?

Accepted Answer

In transit, everything travels over TLS 1.2 or higher with strict transport security enforced. At rest, data and file storage are encrypted with AES-256. Report evidence carries additional access controls on top of that, so only the case managers assigned to a case can open it.

Question 4

Who inside our organisation can see what?

Accepted Answer

Access is role-based and configured by you. Roles are defined per product, so an education administrator does not inherit case access and an analyst does not inherit learner records. Changes to roles and permissions are themselves logged.

Question 5

Is multi-factor authentication available?

Accepted Answer

Yes. Time-based one-time passcodes are supported and can be required for administrators and case managers. Enforcement is set per organisation and per role, so you can mandate it for privileged accounts without imposing it on every learner.

Question 6

Can the platform connect to our single sign-on?

Accepted Answer

Yes, single sign-on is part of a standard institutional deployment and is scoped during onboarding. Where you already run an identity provider, that provider remains the source of truth for who exists and who has left.

Question 7

What is logged, and can we see it?

Accepted Answer

Every authentication, permission change, case action, evidence access and configuration change is written to an audit trail. Administrators can review the trail for their own organisation. Logs are designed to be read as evidence, which means they record who did what, when, and from which session.

Question 8

What happens to our data if we stop working with you?

Accepted Answer

Retention and deletion terms are set in the agreement before deployment. On exit we provide a structured export of your organisation's data and then delete it, including from backups, on the schedule the agreement specifies. You receive written confirmation when deletion completes.

Question 9

How do you handle GDPR and data protection obligations?

Accepted Answer

We act as processor for the organisation data you put into the platform, under a data processing agreement that names the sub-processors we use. The design supports data subject requests, purpose limitation and retention limits. For anonymous reports there is deliberately no identity to disclose, which is the strongest privacy position available.

Question 10

Does the reporting channel meet whistleblower protection requirements?

Accepted Answer

360 Report is built around the principles those regimes require: a channel independent of line management, acknowledgement and follow-up within defined timeframes, confidentiality of the reporter's identity, and a record that demonstrates the organisation acted. Mapping it to the specific instrument that binds you, such as the EU Whistleblower Directive or a national equivalent, is part of the governance work we do with you.

Question 11

Do you use customer data to train AI models?

Accepted Answer

No. Knowledge is indexed into collections scoped to a single organisation and used only to answer that organisation's queries. Your documents, cases and reports are not used to train public models and are not pooled with other customers' data.

Question 12

How do you test the platform's security?

Accepted Answer

Security review is part of the development process rather than an annual event, and we run independent testing against the platform. The scope, cadence and most recent results are shared under NDA, along with our position on any certification a buyer requires.

Question 13

What happens if there is an incident?

Accepted Answer

We contain first, then notify. Named contacts at your organisation are informed with what we know, what is affected and what we are doing, and we follow up with a written account once the cause is established. Statutory notification timelines are built into that process.

Question 14

Can we review the security architecture in detail?

Accepted Answer

Yes. We share a full security overview covering topology, encryption standards, authentication flows, logging, sub-processors, testing and data residency options under NDA as part of procurement. Your information security team can talk directly to ours.

Security is not a feature. It is the foundation.

Built for security, scale and reliability.

Infrastructure

Security

Governance

Five layers. Every request checked at each one.

External

Network

Application

Infrastructure

Data

Intelligence you can audit.

Organisation-scoped knowledge

Model choice under your control

Citation-tracked answers

No training on customer data

Key-scoped API access

Usage logging

Protecting the people who speak up.

Found something?

Request the full security overview.