How we handle your data
This is the one-page sheet that goes into every proposal. It is written to be true before the first call, not after.
What we collect during an audit
Questionnaire answers, tool inventories, log extracts where your IT provider can supply them, and the descriptions on expense lines and card statements that relate to AI subscriptions.
We do not collect message content, document content or client files, and we do not need them to do the work.
Where it is processed
On our own devices and in a private folder created for your engagement. Nothing is uploaded to a shared drive, a ticketing system or a chat tool.
Log extracts and statements are kept only for the engagement and deleted 30 days after the final presentation. The report and the register are retained for as long as you are a client, and for six years afterwards for professional-indemnity purposes.
Which AI tools we use ourselves
Any AI assistant that touches your material runs under a paid business plan whose terms exclude training on inputs, or runs locally on our own hardware. Client-identifiable material is not entered into free or consumer tools.
Where a tool cannot be used on those terms, the work is done by hand, in a spreadsheet. The audit does not need a model to be done well.
Data-processing agreement
A data-processing agreement is available on request and is signed before any log extract is received.
Who countersigns legal conclusions
Legal conclusions in every report are reviewed by an independent solicitor or data protection officer, arranged per engagement. Technical findings are signed by Riserbo.
This website follows the same rule. Fonts are served from our own domain, analytics are cookieless, and no request leaves the page to any third party other than our hosting provider, the form service and the booking tool. The privacy notice names each of them.