Security and data
How we handle your clients’ data
Your practice stays responsible for its clients. This page sets out exactly where their data goes, who can see it and what we will never do with it.
- Kept in the UK
- Client data is hosted, stored and backed up in the UK, and the AI model runs in Amazon Web Services’ London region.
- A person approves
- The AI drafts and sorts. A named person at your firm approves every message for the first two weeks, and for as long after that as you like.
- Every action logged
- What was drafted, who approved it, what was sent and what came back, with times.
- A signed agreement
- We sign a data processing agreement with you before any client data is touched.
- Developers never see it
- Our developers build and test on made-up data, never on your clients’ records.
- Not used for training
- Your clients’ data is never used to train an AI model.
Where the data is
Client data is hosted, stored and backed up in the UK. The AI model is reached through Amazon Bedrock in Amazon Web Services’ London region only, and the system is built to refuse to start if it is pointed at any other region. Amazon’s own documentation says Bedrock doesn’t use prompts and responses to train any AWS models and doesn’t distribute them to third parties (AWS: data protection in Amazon Bedrock).
Two things sit outside our hosting by design. Reminders are sent from your own mailbox, so those emails are held wherever your Microsoft 365 or Google Workspace account already keeps them. And WhatsApp, if you opt in to have it added, passes messages through Meta’s systems outside the UK, which is why it is off unless you opt in.
Sub-processors
These are the organisations that process your clients’ data for us. The data processing agreement names each one.
| Who | What for | Where | Note |
|---|---|---|---|
| UK hosting provider | Runs the Forenax system and its database | United Kingdom | Named in your data processing agreement |
| Amazon Web Services | The AI model (through Amazon Bedrock) and encrypted backups | London (eu-west-2) | The AI is called only in the London region |
| Your email provider | Sends reminders and receives replies from your own mailbox | Set by your existing account | Microsoft 365 or Google Workspace, which you already use |
| Meta (WhatsApp) | WhatsApp messages, only if you opt in | Outside the UK | Off unless you opt in; added per practice |
We tell you before adding or changing a sub-processor, and you can object.
Who can see it
- People at your practice that you choose.
- The Forenax person who runs and supports your system, only when needed to fix a problem you’ve raised.
- Nobody else. Our developers build and test on made-up data in a separate environment, and have no access to live client records or production credentials.
The action log
Every step is written to a log: what was drafted, who approved it, what was sent, what came back and what was filed. The log is append-only. Entries can be added but never edited or deleted, and each entry is linked to the one before it, so a change or a gap can be detected. It gives your practice a record of who was asked for what, and when.
| When | Who | What |
|---|---|---|
| 12 Oct 09:00:02 | System | Reminder 1 drafted |
| 12 Oct 09:12:40 | Emma Wilson | Approved reminder 1 |
| 12 Oct 09:13:05 | System | Sent from accounts@ mailbox |
| 15 Oct 09:00:01 | System | No reply, reminder 2 drafted |
| 15 Oct 09:20:15 | Emma Wilson | Approved reminder 2 |
| 15 Oct 09:20:41 | System | Sent from accounts@ mailbox |
| 15 Oct 14:41:17 | System | Reply received, 3 attachments |
| 15 Oct 14:41:20 | System | Matched to client (rule: sender address) |
| 15 Oct 14:42:02 | System | Case closed, chasing stopped |
Entries are only ever added, never edited or deleted.
Agreements and registration
- We sign a data processing agreement with every practice before any client data is touched. It contains the terms UK data protection law requires, plus terms specific to AI.
- Registration with the Information Commissioner’s Office is in progress.
- At the end of a contract we return your data and delete our copy, on the timetable set in the agreement.
- We don’t hold Cyber Essentials or ISO 27001 certification yet. Cyber Essentials is planned, and we’ll show it here once it’s awarded.
For a copy of our data processing agreement, email info@forenax.com.
What we never do
The lines we don’t cross
- Send anything to a client without the approval rules you set
- Message any client who isn’t on the list you agreed with us
- Change anything in your accounting software. We read; your team posts
- Submit returns or updates to HMRC
- Give tax or accounting advice
- Verify identity for anti-money-laundering on your behalf. We collect documents; your team verifies them
- Move money or touch client bank accounts
- Use your clients’ data to train AI models
- Sell or share your data
- Give developers access to live client records
A question about data or security?
Ask before you agree to anything. We’ll answer in writing, and if we don’t know, we’ll say so and find out.
- You suggest a time
- Thirty minutes on a recent week
- A one-page map within 48 hours