Log in to

Or email [email protected]

Security & trust

Governed from source to screen.

Numbers only help if people believe them, and data only helps if it's safe. Security isn't a layer we added at the end: it's how and are built.

  • ISO/IEC 27001across The Freethinking Group
  • Two-factor sign-infor every account
  • Hosted in London runs in the UK
  • An audit lognobody can edit or delete

The principles

Six things we never trade away.

One definition of every metric

Each metric is defined once, in , and reviewed before it goes live. Whoever wrote a change can't be the one who approves it.

Every number shows its working

Raw data is kept exactly as it arrived. Every figure can say which version of the data and which rules produced it.

Your data stays yours

Clients only ever see their own data, and viewers, editors and admins each get exactly what their role allows. Automated tests check that boundary.

Two-factor sign-in, always

Two-factor authentication is mandatory, repeated sign-in attempts are blocked, and every page is served with strict security headers.

A history you can't rewrite

Changes to the data platform go into an audit log that can't be edited or deleted, and every report keeps its full revision history.

AI on a short leash

Our AI, potent.ai, only sees governed metrics, never does the arithmetic and never publishes anything itself. It only runs where a client has agreed it can.

Access

The right people, and only them.

Nobody signs themselves up. Every account is invited, every sign-in needs a second factor, and every person sees exactly what their role allows.

  • Two-factor sign-in for everyoneAn authenticator code at every sign-in, required for every account, with recovery codes for a lost phone.
  • Invitation onlyThere's no sign-up. People are invited by a client admin or by us, and invitation links expire.
  • A role for every personViewers, editors and admins, set per client. Viewers only ever see published slides, never drafts.
  • Repeated attempts blockedSign-in attempts are limited per account and per address, so guessing gets nowhere.
  • Access you can reviewAdmins see every account, its last sign-in and whether it has gone dormant, so access can be checked and tidied.

Your data

Yours, checked, and kept as it arrived.

The boundary around each client's data is enforced by the server, not by the screen, and only checked, published data ever reaches a report.

  • Your data stays yoursClients only ever see their own data. The boundary is enforced on the server, and automated tests check it.
  • Kept exactly as it arrivedRaw data is never overwritten, so every figure can be traced back to its source.
  • Only checked data is shownA new version is published only when every part has arrived and the counts match.
  • Never a false zeroA figure that's missing, late or incomplete says so. It is never shown as zero.
  • AI with guardrailspotent.ai only sees governed metrics, never does the arithmetic and never publishes anything itself. It only runs where a client has agreed it can.

Infrastructure

Locked down at every layer.

From the network edge to the server itself, access is narrowed to what's needed and everything else is refused.

  • Hosted in London runs on servers in London.
  • Encrypted in transitEvery connection, from your browser to our servers, is over HTTPS.
  • Closed to everything but the web only accepts traffic through our content network, and direct connections are refused. Every server is firewalled to web traffic and key-only administration.
  • Administration by key onlyNo passwords for server access, and repeated failed attempts are banned.
  • Strict headers on every pageA content security policy and security headers on every response, so pages only load what they should.
  • Everything that matters, recordedPublishing, access changes and every two-factor change go into a history that is only ever added to.

Certification & compliance

Held to recognised standards.

ISO/IEC 27001

The Freethinking Group, which Intelligence22 is part of, is certified to ISO/IEC 27001, the international standard for managing information security.

UK GDPR

Personal data is handled under UK GDPR and the Data Protection Act 2018. Our privacy policy covers this website.

Data processing agreement

We agree a data processing agreement with every client before any of their data moves.

The Freethinking Group policies we work to

For your security team

Got a security questionnaire? Send it over.

We'll answer it in full, and walk your team through how and handle your data.

[email protected]