Security you can take to your board

ReadyIntelligence is built for organisations that hold sensitive member data. Here's how it's certified, where your data lives and how permissions keep every answer in bounds.

Four stacked layers of protection: certified hosting, separate client environments, permissions and an audit trail, each highlighted in turn.

Security at a glance

Your data, protected at every layer

  1. 01Certified hostingISO 27001 and SOC 2 Type II, hosted in the US or EU
  2. 02Kept apartYour data sits in its own isolated environment
  3. 03Permission-awareDefault-deny, so people only see what they're allowed to
  4. 04TraceableA full audit trail of every query and answer
ISO 27001SOC 2 Type IIGDPR-ready

01

Certified and independently audited

Security is checked by independent auditors, not just promised, so you have the evidence your board, members and procurement team expect.

  • ISO 27001 certified
  • SOC 2 Type II
  • Designed to support your GDPR obligations
  • Supporting documentation available on request

02

Your data, kept apart

Each client runs in its own isolated environment, hosted in the region you choose, and your content stays inside infrastructure we control.

  • A choice of US or EU hosting, with EU data residency
  • A dedicated database and storage for every client
  • Tenant isolation enforced at infrastructure level, not just in settings
  • Self-hosted search, so your content isn't sent to a third-party embedding service

03

Permission-aware, from day one

A default-deny model means the assistant only uses the sources you've explicitly connected, and it checks each person's access rights every time they ask.

  • Each assistant only uses the sources and tools you give it
  • Every user's access checked at the point of query
  • Staff actions run under their own permissions
  • Fine-grained roles for who can manage agents, data and knowledge

04

Traceable and accountable

Every answer records where it came from and every query is logged, so nothing happens out of sight and your data is never used to train AI models.

  • Citations back to the exact source behind each answer
  • A full audit trail of every query and response
  • Answers only from your content, never the open internet
  • Your data is never used to train foundation models

Related reading

Browse all resources

Security questions, answered

The questions boards, IT teams and procurement ask us most often.

What security certifications does ReadyIntelligence have?

ReadyIntelligence is SOC 2 Type II and ISO 27001 certified, both independently audited. Supporting documentation is available on request for your IT, data protection or procurement team.

Where is our data hosted?

You choose US or EU hosting. With EU hosting, your data and the services that process it stay within the European Union, which matters if you have GDPR or data residency requirements.

How is our data kept separate from other organisations?

Each client runs in its own isolated environment with a dedicated database and storage, so data can't cross from one organisation to another. Every query is scoped to your organisation, and that separation is enforced at infrastructure level, not just in configuration.

Is our content sent to third-party services to be indexed?

No. ReadyIntelligence runs its own search infrastructure, so your documents are indexed and stored on infrastructure we control rather than being sent to a third-party embedding service.

How does the permissions model work?

ReadyIntelligence operates on a default-deny model — the assistant only sees data sources that have been explicitly configured and permissioned. On top of that, it checks each user's access rights at the point of query, so members and staff only ever receive information they are already authorised to see. You can widen access gradually as your confidence in the platform grows.

Which single sign-on options does ReadyIntelligence support?

Two. With OpenID Connect, people sign in through your own identity provider, such as Microsoft Entra ID or Okta, after you register ReadyIntelligence as an application with it. Or your website can pass the assistant a signed token (JWT) for the person already signed in, which ReadyIntelligence verifies before trusting it.

Either way, details your identity provider holds, such as groups or membership type, can decide what each person is allowed to see.

Does ReadyIntelligence train AI models on my data?

No. Your content and data are used to answer your users' questions, not to train foundation models. Information stays within your permissioned knowledge base, with EU data residency available, and is never fed back into general-purpose model training.

Is ReadyIntelligence GDPR-compliant?

ReadyIntelligence is designed to support your GDPR obligations, with permission-aware access controls, source traceability and EU data residency built in, and it is SOC 2 Type II and ISO 27001 certified. Compliance also depends on how your organisation configures and uses the platform, so talk to our team if you need supporting documentation.