The trust statement
What Bracton commits to in writing.
This page answers the eight questions a compliance officer asks first, each tied to something a firm can test, a term it can sign, or an admission that the thing is not held.
- The record lives in the United Kingdom, one database to a firm, and the demonstration runs in London today. Built.
- The record is backed up every hour, sealed, and a restore is rehearsed every week, the result written to the audit trail. Built.
- A firm takes its whole record out at any time, in plain files, without asking. Built, and contracted.
- Nothing a firm holds trains any model, at Bracton Ltd or at the provider behind the assistant. Contracted.
Illustrative. Three screens from the working software, on invented files. The platform, screen by screen.
How to read this page
Each answer carries one of three words at its head. Built means it runs today and a firm can watch it on the demonstration. Contracted means a term Bracton Ltd puts in writing in the agreement, testable from outside or not.
Not held means Bracton does not have the certificate or the figure, and the page says so rather than reaching for a substitute.
The eight questions
i.
Where does the record live
Built. Every firm has its own database, held in the United Kingdom, and the demonstration runs in London.
How it works
Each firm’s files, papers, diary, ledgers and audit trail stand in a database of that firm’s own, and the separation sits in the database’s own permissions rather than in code.
How the separation is tested
An automated suite signs in as one firm and reaches for another’s records through every door, and a single record returned fails the build.
The host for a paying firm
The demonstration firm runs today in the London region of a hosting company.
It does not settle the host for a paying firm, chosen against the residency rule before the first firm signs and named on the security page.
ii.
How often it is backed up
Built. Every hour, sealed, anchored to the audit trail, and a restore is rehearsed every Sunday with the result recorded.
How it works
Every database is dumped every hour and sealed under a key the server holds apart from the data, and the fingerprint of the seal goes to the audit trail.
How far back a firm reads
Every set of the last two days is kept, then one a day to thirty five days, the processing agreement’s window.
The Sunday rehearsal, and its record
The restore goes into a scratch database and proves it reads, written to the trail as passed or failed.
iii.
What can nobody edit
Built. Every act on the platform is written to an append only trail in which each entry carries the fingerprint of the one before, reads included.
How it works
An entry removed or altered breaks every entry after it, and the break is visible. A file opened, money moved, a letter held, a bill delivered, a sign in refused, all of it lands there.
Money moves through the platform’s writers
They refuse an act the Accounts Rules would not allow and name the rule, and every refusal is on the trail beside every success.
iv.
Does anything train a model
Contracted. Nothing a firm holds trains, tunes or evaluates any model, at Bracton Ltd or at the model’s provider, and the route is named.
How it works
The model is reached in the London region or through the provider’s own service, and a firm bound by the residency rule runs the London route. The provider is named on the sub processor list you read in due diligence.
The terms the provider is on
On both routes the provider’s published terms exclude the use of a customer’s content to train or improve models, and Bracton Ltd contracts on no others.
What leaves the firm’s database
A brief drawn from the file at the moment of asking, in sentences the person reads on the same screen, and the question. No card, no credential, no key and no other firm’s file goes with it.
The answer comes back onto the file in the asker’s name with the tokens it cost, added up by month in Reports.
v.
How does a firm leave
Built, and contracted. The whole record as plain files from Settings, any file as its own copy, at any time, without a fee, a reason or a request to anyone.
How it works
The export is the files, the clients, the casts, the diary, the time, the ledger and the audit trail as comma separated tables, and every paper as text, in one zip any tool opens.
A single file, and the sealed copy
A solicitor takes a single file the same way, and a sealed copy exists beside it for a costs draftsman or counsel outside the firm. Each taking is an act on the record in the taker’s name.
What the agreement says
The right runs throughout the agreement and for ninety days after it ends, survives any dispute and any suspension, and needs nobody’s permission.
vi.
Who gets in
Built. Sign in through the firm’s own Microsoft directory or a passkey, a registered device for anything that leaves, and a second proof at the moment money moves.
How it works
Sign in is through the firm’s own Microsoft Entra directory, so the firm’s joiners and leavers are the platform’s. An unregistered device reads but keeps nothing and takes nothing out.
The acts that ask again
Five acts ask for the second proof at approval rather than at the start of the day, the release of a bill and a payment out of client account among them.
Roles, and the information barrier
What a person may do follows their role, a solicitor, a partner, a cashier, a paralegal or an administrator, and a refusal names the role that holds it. A barrier hides that file’s client from everyone outside the wall.
vii.
What is certified and not
Built for Cyber Essentials, not held for the rest. Bracton Ltd holds a Cyber Essentials certificate in its own name. SOC 2 and ISO 27001 are not held and are not claimed.
How it works
The certificate of assurance is number ef2524f2, issued by IASME on 5 August 2026 against version 3.3 of the scheme, whole organisation in scope, due for recertification on 5 August 2027.
Why a parent certificate
It is the child of a parent certificate held by an associated company providing the devices and tenant the work runs on, and Bracton Ltd was assessed in its own right.
SOC 2 and ISO 27001
The path is Cyber Essentials Plus first, a technical test rather than a questionnaire, then ISO 27001 once there is a year of operation.
viii.
When something goes wrong
Contracted, and stated plainly. A named person answers, an incident is disclosed to the firm rather than managed quietly, and no uptime percentage is published because there is no operating history.
How it works
Bracton Ltd has one director and no employees, and the business continuity policy says so before anything else.
What bounds the damage
The platform runs without a hand on it on an ordinary day, the backups and the rehearsal run on timers, and the export is a press away.
Support, and no uptime figure
Support is the director, by telephone and email on working days, and the agreement names a response time. An incident touching a firm’s data is disclosed to it.
The status page carries what runs, what is in build and what is undecided, dated.
The working behind each stands on the security page and the page behind it, and every item a buyer asks about sits in one of four states on the status page.
Contact
Agree the requirement before signature
If something here falls short, say which part before signature.
Put a security question to us