# Information Security Statement

**Last Updated:** June 2026

This Information Security Statement is designed for Enterprise IT and Procurement teams to understand the technical safeguards, architecture, and security protocols implemented by PrivacyGuard AI. 

## 1. Local-First & Masking Architecture
PrivacyGuard AI is built on a fundamental philosophy of data minimization and local-first processing.
*   **Client-Side Masking:** Before any payload is transmitted to an external inference API, our proprietary Natural Language Processing (NLP) pipeline executes entirely within the user's browser or local environment.
*   **PII Redaction:** The pipeline automatically detects and masks Personally Identifiable Information (PII) including names, emails, addresses, National Insurance numbers, and UK phone numbers. 
*   **Zero-Knowledge Transmission:** The external LLM providers (e.g., Mistral AI) receive only tokenized, anonymized text, ensuring that raw personal data never leaves the Client's local network.

## 2. Infrastructure & Hosting Security
*   **Data Sovereignty:** All persistent backend infrastructure, relational databases, and diagnostic logging clusters are hosted exclusively within United Kingdom data centres (AWS London Region `eu-west-2` / Microsoft Azure UK South).
*   **Encryption at Rest:** All databases and backup storage volumes are encrypted at rest using industry-standard AES-256 encryption.
*   **Encryption in Transit:** All communications between the Client's browser, the Platform backend, and external API gateways are secured using TLS 1.2 or TLS 1.3 encryption.

## 3. Access Control & Bring-Your-Own-Key (BYOK)
*   **API Key Isolation:** The Platform utilizes a Bring-Your-Own-Key (BYOK) model. The Client's inference API keys are stored securely and used exclusively for the Client's own sessions.
*   **Authentication:** Access to the Platform requires strong authentication. Session tokens are strictly managed and expire automatically after periods of inactivity.
*   **Role-Based Access Control (RBAC):** Internally, PrivacyGuard AI strictly limits administrative access to production systems. Access is granted on a least-privilege basis and requires Multi-Factor Authentication (MFA).

## 4. Incident Response
PrivacyGuard AI maintains an active Incident Response Plan. In the event of a confirmed security incident affecting Client Data, we are contractually bound (via our Data Processing Addendum) to notify affected Data Controllers within 72 hours, providing technical details and mitigation steps.

## 5. Compliance Framework
Our architecture is designed to map directly to the requirements of the UK Data Protection Act 2018 (UK GDPR) and aligns with core principles of ISO 27001 information security management. By isolating data on the client side, we drastically reduce the compliance burden and risk profile for enterprise deployments.