No model training
Your documents are never used to train or fine-tune any AI model — ours or any third party’s.
Data handling
How QualCheck handles data.
Document upload
Minimum TLS 1.2, encrypted in transit
Encrypted transfer
AES-256 at rest, no local storage
Isolated processing
Application-layer workspace isolation
AI analysis
No training on client content
Structured report
Delivered to authorised users only
Stored securely
Deleted on account closure (30 days)
Data minimisation
Source documents are retained while your account is active. Upon account closure, all data is deleted within 30 days. You may request deletion at any time.
Jurisdiction control
Data is processed within your jurisdiction. We do not transfer content across borders without explicit instruction. Currently available: AWS London (eu-west-2), with additional regions coming soon.
Access controls
Role-based access with full audit logging. Only authorised users within your organisation can view results.
Transparency
We publish our data handling practices in full, and answer detailed security questionnaires from enterprise partners.
Right to erasure
You can request deletion of all associated data at any time. We comply within 30 days and provide written confirmation.
FAQ
Common questions
How is AI used in QualCheck?
QualCheck uses the Claude AI model (created by Anthropic) for analytical processing, accessed via AWS Bedrock. Your data stays within our AWS environment — Anthropic does not see or access your data. The model processes your data for analysis only, without storing it or using it for any other purpose. The specific model version may change over time as more capable models become available.
Is my data used to train AI models?
No. Your data is never used to train any AI model — ours or anyone else’s. We do not use client data to improve shared systems or benefit other organisations unless you explicitly agree.
Is my data shared with other clients?
No. Data is isolated at the client level within the platform. Your materials remain entirely separate from other organisations’ data. We do not pool data across clients or use your content to improve other clients’ systems.
How is client data isolated?
QualCheck uses application-layer tenant isolation. All client data is logically separated by workspace ID at the storage, processing, and access levels. Storage has no public access and uses encrypted paths with short-lived permission-validated URLs. Processing is stateless per workspace with no shared context between clients. Access requires workspace membership with explicit project-level permissions, and platform admins cannot view client content or analysis results.
How is my data secured?
We implement encryption in transit (TLS) and at rest. Access controls restrict data access to authorised systems and personnel only where required to operate the service. Infrastructure is hosted on Amazon Web Services (AWS) with security configurations aligned to high-trust environments.
How long is my data retained?
Data is retained while your account is active. Upon account closure, data is deleted within 30 days unless otherwise agreed or required by law. You may request deletion at any time.
Where is my data processed?
The QualCheck platform currently runs entirely in the AWS London region (eu-west-2). In time, we can replicate to other regions to support specific client requirements.
Who processes my data?
Our primary subprocessor is Amazon Web Services (AWS), which provides cloud infrastructure and AI model inference via AWS Bedrock. AWS processes data on our behalf under a Data Processing Agreement with equivalent data protection obligations. AWS does not use your data for its own purposes.