Skip to content

ATB.

Trust Centre

At The Beyond builds AI products for frontline teams and puts them to work inside your business: FrontlineOS, CommerceOS, MarketingOS and AI advisory. Headquartered in London, we work with clients across markets. This is how we protect the data, systems and people our products touch.

Last updated

Certifications and frameworks

  • Certified

    Cyber Essentials

    The UK government-backed scheme covering firewalls, secure configuration, access control, malware protection and patching.

    44ae96ef-85a4-40cf-8f7a-1c22f5077045 (opens in a new tab)

  • In progress

    Cyber Essentials Plus

    The same five controls, independently tested on our own devices and accounts.

  • Compliant

    UK and EU GDPR

    How we collect, use and protect personal data, and the rights people have over it.

  • Compliant

    EU AI Act

    Transparency, risk assessment and human oversight, applied per the Act's risk tiers.

  • Compliant

    CCPA / CPRA

    California residents' rights to know, delete, correct and opt out. We never sell or share personal information.

  • In progress

    ISO/IEC 27001:2022

    The international standard for an information security management system.

  • Planned

    ISO/IEC 42001:2023

    The international standard for managing AI systems responsibly.

  • Registered

    ICO registration

    Registered with the UK Information Commissioner's Office as a data controller.

    ZC187154 (opens in a new tab)

Controls

Infrastructure security

  • Remote access MFA enforced
  • Remote access encrypted
  • Production data kept out of non-production environments
View 5 more infrastructure security controls
  • Unique authentication to production systems
  • Data encrypted at rest
  • Production spread across multiple availability zones
  • Tenant isolation between client environments
  • Firewalls, malware protection and patching within 14 days

Organisational security

  • Employee background checks performed
  • Security awareness training at hire and annually
  • Production asset inventory maintained
View 2 more organisational security controls
  • Confidentiality agreements signed at onboarding
  • Asset disposal with certificates of destruction

Internal security procedures

  • Incident response plan tested annually
  • Incident response policies established
  • Management security roles and responsibilities defined
View 6 more internal security procedures controls
  • Security policies documented and reviewed annually
  • Security roles assigned in job descriptions
  • Incidents logged, tracked, resolved and communicated
  • Formal software development life cycle
  • Business continuity and disaster recovery plans
  • Cloud provider physical security reviewed annually

AI security and compliance

  • AI management system scope defined
  • AI policy established and communicated
  • Evaluation harnesses, guardrails and output validation
View 4 more AI security and compliance controls
  • Defences against prompt injection, data exfiltration and jailbreaks
  • Human approval for high-impact or irreversible agent actions
  • AI risk assessments and DPIAs where required
  • Client data never used to train models without written agreement

Product security

  • Data encrypted in transit (TLS)
  • Vulnerability management and system monitoring procedures
  • Audit logging of access and system behaviour
View 1 more product security controls
  • Code review and change management

Data and privacy

  • Data retention and disposal procedures
  • Data classification policy
  • Data deletion requests handled
View 5 more data and privacy controls
  • Personal data collection limited to what is necessary
  • EU representative appointed
  • Client data deleted when a client leaves
  • Personal data encrypted in transit
  • Transfers to third parties verified

Data we handle

  • We handle: Business contact details

    Names, work emails, job titles

  • We handle: Client operational and business data

    Only on documented instructions, under a contract and DPA

  • We handle: Voice audio and transcripts

    Where a client deploys our voice products

  • We handle: Website usage data

    Analytics only with your consent

  • We handle: Billing and invoicing records

  • We do not handle: Full payment card numbers

    Held by our payment processors

  • We do not handle: Special category data

    Health, biometric or ethnic origin data, unless agreed in writing for an engagement

  • We do not handle: Selling personal data

    Never

Subprocessors

  • Amazon Web Services

    Cloud hosting and infrastructure

  • Microsoft Azure

    Cloud hosting and AI model access

  • Google Cloud

    Cloud hosting and AI model access

  • Oracle

    Cloud infrastructure and databases

  • Vercel

    Web and application hosting

  • Supabase

    Application database and authentication

  • Neon

    Serverless Postgres databases

  • Anthropic

    AI language models

  • OpenAI

    AI language models

  • Cerebras

    AI model inference

  • Deepgram

    Speech recognition

  • ElevenLabs

    Voice synthesis

  • Cartesia

    Voice synthesis

  • LiveKit

    Real-time voice and media

  • Twilio

    Telephony and SMS

  • SendGrid

    Transactional email

  • Google Workspace

    Email, documents and collaboration

  • Microsoft 365

    Email, documents and collaboration

  • Salesforce

    Customer relationship management

  • Slack

    Team communication

  • LangChain

    AI application tracing and evaluation (LangSmith)

Policies and documents

Frequently asked questions

Do you use our data to train AI models?

No. Client data is never used to train At The Beyond, public or third-party AI models without your explicit, written agreement. We use enterprise tiers of model providers, under terms that stop them training on your content.

Where is our data stored?

Our products run in a dedicated environment for each client, and where it is hosted is agreed in the engagement design. Where personal data leaves the UK or EEA, we use recognised safeguards such as the UK IDTA, the UK Addendum or EU Standard Contractual Clauses.

How is our data protected?

Data is encrypted in transit and at rest. Access uses multi-factor authentication and least privilege, each client's environment is isolated from every other, and access and system behaviour are logged and monitored.

Which AI model providers do you use?

Anthropic and OpenAI, directly or through Microsoft Azure, AWS and Google Cloud, with Cerebras for fast inference; and Deepgram, ElevenLabs, Cartesia, LiveKit and Twilio for voice. The providers used in each engagement are documented in its engagement design and data processing agreement.

Will you sign a data processing agreement?

Yes. Every engagement that involves personal data runs under a written contract and a DPA meeting UK GDPR and EU GDPR Article 28. It sets out the subprocessors, retention, deletion and your audit rights.

How long do you keep our data?

Retention and deletion are defined for each system and written into the DPA. Project records are kept for the engagement plus seven years for contract and tax purposes; security and audit logs for 30 days to 12 months. When data is no longer needed, it is securely deleted or irreversibly anonymised.

Who is accountable when an AI system gets something wrong?

People, always. Every system we deliver has named owners on our side and yours, with clear escalation, override and rollback paths. High-impact or irreversible actions by AI agents need human approval.

What happens if there is a security incident?

We follow our incident response procedure: contain, investigate, and notify affected clients without undue delay under the terms of their DPA. Where the law requires it, we report personal data breaches to the ICO within 72 hours.

Report a security concern

privacy@atbeyond.com