Performance of contract (operating the Service) and legitimate interests (security, fraud prevention, product improvement). Where the customer processes personal data about claimants/third parties through the Service, the customer is the controller and we act as processor.
Where is data stored?
Within the EU/UK on managed cloud infrastructure with encryption in transit and at rest. International transfers (if any) are covered by appropriate safeguards (e.g. SCCs).
2. PII Masking Architecture
How is PII handled before it reaches the AI?
A mandatory server-side masking gateway sits in front of every AI call. It detects and replaces common UK identifiers - person names (titled names always, bare names in field-label, salutation and sign-off contexts), emails, phone numbers, NI numbers, VRMs, DOBs, bank details, policy/claim references and street addresses - with neutral placeholders. UK postcodes are deliberately preserved because they are material to basic-hire-rate and locality arguments; a separate output-side scrubber removes any postcode the AI introduces that was not present in the original input.
What happens to PII at rest in your database?
A second masking pass runs at the database level via PostgreSQL triggers (public.mask_pii()) before persistence. Saved correspondence, AI replies, case advice and pre-emptive letters contain placeholders rather than raw identifiers, even when accessed directly.
Can residual PII be scrubbed if you find some?
Yes. Records can be re-masked or deleted on request. AI provider prompts are processed under zero-retention enterprise terms and are not retained for training or storage by the model provider, so there is nothing to scrub at the model layer.
3. Document & PDF Handling
Are uploaded PDFs stored on your server?
No, not for typed, text-based PDFs. They are processed entirely in the user's browser using PDF.js; only extracted text is sent to our backend. Scanned PDFs and photographs are the exception, see below.
What about scanned (image-only) PDFs?
The browser cannot read these, because there is no text inside them to extract. The page itself is read by the AI (OCR) under zero-retention, no-training terms, and the personal identifiers we can detect are masked in the returned text before any analysis call. Depending on the tool the file is either placed in a private temporary storage bucket for OCR, deleted immediately after processing with a scheduled job removing any object older than 24 hours as a safety net, or held in memory for a single request and never stored.
What does the Loss-of-Use Chronology tool store?
Nothing. Uploaded documents are held in memory for the length of a single request, masked, read and returned to the browser. No row is written to any table and no file is written to any storage bucket. The tool ingests the engineer's report, the payment pack (hire agreement and invoice), the GTA Hire Period Validation Form, and repair and hire monitoring notes. It has no medical or injury document slot. Access is controlled by a per-client feature flag and the tool is currently limited to a single client in controlled beta.
3a. Recent Compliance Activity
Date
Entry
7 August 2026
Loss-of-Use Chronology tool entered controlled beta behind the per-client loss_of_use_chronology feature flag, defaulted off for all clients, with a zero-storage design (no table writes, no bucket writes).
18 August 2026
Compliance review of the Loss-of-Use Chronology tool completed: document categories, zero-storage design, PII masking coverage and feature gating confirmed and documented.
19 August 2026
Admin bypass removed from the Loss-of-Use Chronology route guard. Access is now governed purely by the per-client feature flag, which is enabled for the Icon client only. Administrators on other clients can no longer reach the tool by URL.
20 August 2026
Scanned-document and OCR accuracy wording round: public pages and policy documents updated so that local-extraction claims are qualified as applying to typed documents, and the OCR-then-mask path for scanned PDFs and photographs is described explicitly.
4. Retention
CreditHire Assist is designed not to retain personal case data. Uploaded text and the outputs the tool generates are deleted immediately on session close. A continuous scheduled purge runs as a backstop, so nothing is ever retained beyond 24 hours. Users save anything they need to keep to their own systems (a copy button is provided) and re-run if required.
Data type
Retention period
Account / profile data
Life of account + 30 days
Uploaded text, AI replies, case advice, pre-emptive letters and other case outputs
Deleted immediately on session close; continuous scheduled purge ensures nothing is retained beyond 24 hours
Activity / audit logs
12 months
Temporary scanned-PDF files (OCR only)
Deleted on completion; max 24h via scheduled purge
Database backups (disaster recovery)
Uploaded files are never included in any backup. Standard disaster-recovery backups exist for the database, but because case content is deleted within 24 hours those backups hold essentially no personal case data, and once a record is deleted there is nothing to restore it from.
AI prompts (after masking)
Not retained - Zero Data Retention enterprise terms with provider
Special category data: The Service is not intended for special-category data and users are asked not to submit it. We recognise that in credit hire work, health, injury or vulnerability information can incidentally appear in free-text correspondence. Where it does, the same safeguards apply (masking, data minimisation, encryption and immediate deletion), and as data controller the customer remains responsible for the Article 9 lawful basis.
Data Processing Agreement: A Data Processing Agreement (DPA) is available to enterprise customers on request. Contact info@caseflowautomation.co.uk.
5. AI Governance
Do you train AI models on customer data?
No. We do not train or fine-tune models on customer data, and our AI provider is contracted not to use prompts/outputs for training.
How do you prevent hallucinated case law?
Closed knowledge base; prompts forbid uncited authority; deterministic model settings; mandatory limitation language when no authority exists; outputs presented as drafts requiring human review.
Is AI making decisions on behalf of users?
No. All outputs are decision-support drafts. A human reviews and approves before any action is taken.
6. Access Control & Authentication
Per-tenant data isolation enforced via PostgreSQL Row-Level Security.
Role-based access (handler, manager, admin) - admins do not see correspondence content.
Suspended users are blocked at both the policy layer and the application layer.
7. Audit & Logging
All AI invocations and feature usage are logged (user, company, timestamp, function).
PII masking logs record categories and counts only - never original values.
Login attempts, suspensions and admin actions are logged for 12 months.
8. Sub-Processors
We engage the following sub-processors to deliver CreditHire-Assist. Their processing is governed by data processing terms no less protective than those we owe our customers. The list is reviewed regularly and updated on material change.
Sub-processor
Service provided
Location
Supabase Inc. (via Lovable Cloud)
Managed PostgreSQL, authentication, file storage; hosted on AWS
EU (eu-west-2, Ireland)
Lovable (platform & hosting)
Application hosting, CI/CD, AI Gateway routing
EU
Google LLC (Gemini, via Lovable AI Gateway)
AI inference under zero-retention enterprise terms
EU routing via Lovable; transfers under UK IDTA / SCCs
Cloudflare, Inc.
CDN, TLS termination, traffic proxying
Global edge, EU-preferred
Resend, Inc.
Transactional email
EU / US, under DPA
Lovable's published Data Processing Agreement, including the published sub-processor list, is available at trust.lovable.dev and is incorporated by reference. The hosting region for our project is EU (Europe, Ireland). Transfers outside the EU at the AI inference layer are safeguarded through Standard Contractual Clauses at the Lovable-to-Google contractual layer; the formal IDTA / UK Addendum to the EU SCCs and Transfer Impact Assessment documentation is available via Lovable's Trust Center on B2B compliance request.
9. Incident Response & Breach Notification
Security incidents are logged in a dedicated incident register with severity, scope and remediation.
Where a personal data breach is likely to result in a risk to data subjects, we will notify affected customers without undue delay and the ICO within 72 hours, in line with UK GDPR Art. 33.
10. Policy Acknowledgements
All users acknowledge our Privacy Policy, AI Safety & Security Policy and Terms on signup. When we issue a material policy change, users are required to re-acknowledge the updated version on next login.