What a compliance officer is entitled to test.

Where your data is held

• United Kingdomevery production record, backups and audit trail included
• Your own databaseone firm's records kept from another's in the database itself
• Your firm is the controllerwe disclose matter content only on your instruction or where the law compels
• Named sub processorsa list you see, with notice before an addition and a route to object

Who can reach it

• Registered device and passkeyminted on the person's own device, proved by face, fingerprint or PIN
• Your firm revokesa revoked device ends every live session on it
• Engineers see invented datalive client material is read only against a written fault, approved by a second person, time limited and logged
• Nothing trains a modelat Bracton Ltd or at the provider behind the assistant

Trust statement

Certified

Cyber Essentials, certificate ef2524f2, issued to Bracton Ltd on 5 August 2026.

Cyber Essentials Plus, an independent penetration test, then ISO 27001 and ISO 42001, in that order. The trust statement says what is certified today and what is not.

If your firm leaves

Your matters, documents, correspondence and ledgers belong to your firm. At the end of the contract they are returned or deleted on your election, evidenced either way. The money actions, the log, the backups and what happens during an incident are set out in the controls day to day, and the people in supervision.