Security and data
Security and data protection for regulated AI
Your data. Your evidence. Clear control.
Security facts
ISO 27001:2022
Certified Information Security Management System covering the whole Recordsure organisation.
Cyber Essentials Plus
Independently assessed certification over technical controls protecting against common cyber threats.
UK Azure hosting
Core service hosted in Microsoft Azure UK, with resilience in Microsoft Azure UK (secondary location).
CREST pen testing
Product, API and infrastructure penetration tested at least annually and after significant change.
Audit trails
All customer and AI activity can be recorded in searchable audit trails, subject to product and configuration.
Recordsure protects the customer conversations, documents, case material and intelligence entrusted to our platform through secure UK hosting, controlled access, encryption, client-data separation and evidence-led auditability. Your authorised users retain access to the underlying records and the information created from them, while retention, integrations and operating controls are agreed around your requirements.
Security is not an add-on to Recordsure. Our technology, operations, people and data-handling practices are governed within an ISO 27001:2022-certified Information Security Management System.
How Recordsure protects your data
Designed for organisations where data protection and evidence matter
What data does Recordsure process?
Recordsure works with the information needed to provide the products and services selected by each client. Depending on the agreed scope, this may include customer meeting recordings, transcripts, documents, emails, case files, structured customer or workflow data, review conclusions, user-entered information and system-generated findings.
Conversation Intelligence works with meetings and calls, including recordings, transcripts, structured notes, themes and configured checks. Document Intelligence works with documents, emails and case evidence, including classifications, dates, timelines, bookmarks, findings and audit trails.
Recordsure processes client data for the agreed service and in accordance with the applicable contract, data-processing terms and documented instructions. The precise data flows, integrations and access model are established during implementation.
Your evidence remains accessible and traceable
Recordsure is designed to preserve access to the evidence beneath the intelligence. Authorised users can move from a note, theme, check or finding to the relevant recording, transcript passage, document section or case material, subject to their permissions and the agreed configuration.
This evidence-linked approach helps people verify AI outputs, understand how a conclusion was reached and create a defensible record of the human judgement applied. User actions, AI activity and data changes can be logged and made searchable to authorised users.
Clients can access and export information through product downloads, reports, data feeds, APIs or agreed integrations, depending on the capabilities included in their implementation.
Hosting and data residency
For the standard UK service, Recordsure operates within Microsoft Azure UK, with data resilience and disaster-recovery arrangements in a secondary location within Microsoft Azure UK. Client data for this service is hosted and supported within the UK, with access limited to authorised personnel according to their responsibilities.
Alternative isolation or deployment models may be available for specific requirements, including deployment arrangements within a client’s Azure estate. The selected model, residency requirements and connectivity are agreed during solution design and contracting.
Encryption and secure transfer
Recordsure applies appropriate encryption and secure-transfer controls to data in transit and at rest. Microsoft Azure Key Vault is used to protect encryption keys and other infrastructure secrets, with additional key-management and client-isolation options available where required.
Secure integrations can use APIs, managed file transfer, private connectivity or other agreed mechanisms. The transfer route, authentication method, data mapping and operational controls are confirmed for each integration.
Identity, permissions and access
Customer access is controlled through single sign-on. Implementations can integrate with the client’s Microsoft Entra ID policies, including the client’s multifactor-authentication requirements.
Configurable role-based access controls determine which functions and information each user group can view, create, amend or administer. Access can be organised by role, team, department, business unit or, where needed, individual case. These controls are enforced below the user-interface layer and are included in security testing.
Recordsure applies least-privilege principles to internal access. Access needed for technical operations, support, configuration or authorised AI work is controlled, logged and reviewed within the Information Security Management System.
Client-data separation
Recordsure uses client-specific environments and access controls to keep client records, annotations, configurations and runtime processing separated. Client-specific AI models and prompts are deployed for the relevant client where the capability requires them.
The architecture is designed so that a user or integration can retrieve only the records and functions permitted for that client and role. Additional isolation options can be agreed for organisations with enhanced security or tenancy requirements.
Retention, deletion and legal hold
Data-retention periods and deletion rules are agreed contractually and configured for the client’s needs. Recordsure can support automatic expiry, controlled deletion requiring authorised approval and interim deletion to support valid data-subject requests.
Cases can be placed on legal hold to prevent deletion while an investigation, complaint, dispute or regulatory matter remains active. At the end of the service, data is returned or exported as agreed and remaining client data is destroyed in accordance with the contract, with deletion evidence available where applicable.
Monitoring, backup and recovery
Recordsure monitors infrastructure, platform services, applications, microservices and integrations. Monitoring and alerting support rapid identification and diagnosis of service issues, while self-healing and auto-scaling capabilities help maintain availability under changing load.
Data is protected through Azure resilience and geo-replication arrangements across UK regions. Backup, recovery, continuity, incident-management and change-control processes are governed through the Information Security Management System and tested according to the applicable control framework.
AI and data use
Is client data used to train AI models?
Recordsure uses different AI methods for different tasks, so the answer depends on the capability selected and the agreed implementation. Any use of client data for model improvement is controlled, purposeful and governed within the client’s environment and contractual instructions.
Client-specific models
Some predictive capabilities, including document classification, evidence identification or speech recognition, may be trained or refined using data from the relevant client. Where client-specific training is used, the resulting custom model is deployed for that client, and sensitive or identifying information is redacted or transformed as required by the training method.
Generative AI
Recordsure does not train or fine-tune generative large language models on client data. Generative models are used only for functions that require generated text, such as summaries or answers about an authorised case. Prompts and outputs are processed through controlled Microsoft Azure deployments and are not used to train those foundation models.
Shared predictive learning
Where Recordsure's predictive models benefit from patterns across clients, source text is redacted as required and transformed into vector representations before model training. Encoder-only models do not contain or generate source text, and the model architecture is designed to prevent reconstruction of individual client records.
Certifications and independent assurance
Independently certified and verified
Certificates and supporting assurance documents are available to prospective and existing clients through the appropriate due-diligence process.
ISO 27001:2022
Recordsure's full organisation is within the scope of its certified Information Security Management System, covering the technology, operations, people and processes used to deliver and support the service.
Cyber Essentials Plus
The independently assessed Cyber Essentials Plus certification provides additional assurance over the technical controls used to protect against common cyber threats.
Independent penetration testing
A CREST-certified organisation tests Recordsure's product, APIs and infrastructure within the hosting environment at least annually and after significant updates.
Frequently asked questions
Security and data — frequently asked questions
Yes. Authorised users can access the underlying evidence and Recordsure outputs through the product. Export options may include downloads, reports, data feeds, APIs and agreed integrations, depending on the implementation.
No. Recordsure does not train or fine-tune generative large language models on client data. Client-specific predictive or speech models may be refined using the relevant client’s data where this is agreed and required for the selected capability.
Customer access uses single sign-on and can follow the client’s Microsoft Entra ID and multifactor-authentication policies. Configurable role-based controls restrict access to the functions, teams and cases appropriate to each user group.
Recordsure can maintain searchable audit trails for user activity, AI activity and data changes. Access to audit information is restricted to authorised roles and can be included in agreed export or security-monitoring arrangements.
Retention is agreed contractually and configured for the client’s legal, regulatory and operational requirements. Recordsure can support automatic expiry, controlled deletion, data-subject requests and legal holds.
Integrations use authenticated, encrypted routes and agreed data mappings. Depending on the requirement, these can include secure APIs, managed file exchange, private connectivity and controlled data feeds.
Security events are handled through Recordsure’s governed incident-management process. Monitoring, investigation, escalation, containment, recovery and client communication follow the applicable contractual and regulatory requirements.
Recordsure’s whole organisation is within the scope of its ISO 27001:2022-certified Information Security Management System. Recordsure also holds Cyber Essentials Plus, and its product, APIs and infrastructure are independently penetration tested by a CREST-certified organisation.
Yes. Recordsure applies appropriate encryption and secure-transfer controls to data in transit and at rest. Microsoft Azure Key Vault protects encryption keys and other infrastructure secrets.
Recordsure uses client-specific environments and access controls to keep client records, configurations and runtime processing separated. Additional tenancy and isolation options can be agreed for enhanced requirements.
Recordsure uses Azure resilience and geo-replication across UK regions, supported by governed backup, recovery, continuity and incident-management processes. Specific recovery commitments are confirmed contractually.
Certificates and supporting assurance documents are available to prospective and existing clients through the appropriate security due-diligence process.
Discuss your requirements
Discuss your security and data requirements
Talk to Recordsure about your information-security policies, data residency, identity, integration, retention and assurance requirements. We will explain the standard service, identify where additional isolation or controls may be appropriate and provide the evidence needed for your due-diligence process.