Confidential. Controlled. Customer-Owned.

ClaimStay Control is a multi-tenant platform with strict logical isolation enforced at every layer: database, application, API, and model inference.

• No query, prompt, output, or data object crosses a tenant boundary under any circumstance.
• Per-tenant encryption keys are managed in a dedicated KMS. No cross-tenant key reuse.
• Tenant boundaries are tested by independent penetration testing at least annually.
• Shared infrastructure is limited to non-data components (load balancing, monitoring, authentication routing).

Access to case data is governed by a layered control set:

Every read, write, and state change is logged. The audit log records:

• Actor identity and actor type (human user or system process).
• Action taken and the target entity.
• Before-state and after-state values.
• Source document or event referenced, where applicable.
• Timestamp to millisecond precision.

Logs are append-only and cannot be edited or deleted by any user, including ClaimStay Control staff. Logs are exportable by the Customer at any time.

The Platform is designed to keep confidential material controlled at every interaction point.

• Confidential material is clearly marked in both the UI and in generated artefacts (exports carry “Confidential · ClaimStay Control · Customer Record” in the footer).
• Draft records and system-generated summaries are internally marked as drafts. They are never shared externally without explicit human approval.
• Sensitive free-text (including vulnerable customer detail) is excluded from management information and exports; structured flags only.

ClaimStay Control personnel do not access Customer case data except in two narrowly defined circumstances:

• Authorised support. A Customer raises a support request and explicitly grants temporary, scoped access. Access is logged and revoked automatically.
• Incident response. A security incident requires investigation. A defined incident commander authorises read-only access for the minimum team required. Every action is audit-logged and reported to the Customer.

All personnel with potential access are bound by employment confidentiality obligations and the Responsible AI Code of Conduct. Training is refreshed annually and verified.

Case data does not leave the UK / EU region of the Customer’s tenancy. Support access that would require temporary extraction is subject to a documented data-transfer agreement and is never granted by default.

In the event of a confirmed personal data breach affecting Customer case data, affected Customers are notified without undue delay and in any event within 72 hours of discovery, consistent with UK GDPR requirements. Notification includes the nature of the breach, data affected, containment steps, and remediation plan.