Security & data protection
You're uploading your management-system documents — here is exactly how we treat them. Written for the procurement and DPO questions consultancies actually ask.
Your documents are deleted after analysis
Uploaded EMS documents are processed for the duration of the scan and then deleted from our servers. What we retain is the scan result — clause findings, scores, and short evidence excerpts — so your reports and progress history keep working. Anonymous free-scan results are automatically deleted after 90 days.
UK/EU infrastructure
Scanning runs on our EU-based servers, account data lives in an EU-region database (Supabase, eu-west-1), and traffic is fronted by Cloudflare. AI analysis is performed via Anthropic under a signed Data Processing Agreement with EU/UK transfer safeguards. The full sub-processor list, with transfer mechanisms for each, is published in our privacy policy.
Encryption & access control
All traffic is encrypted in transit (TLS via Cloudflare). Application data is protected by row-level security — every query is scoped to the authenticated account, enforced at the database layer, so one customer can never read another's scans, clients, or reports. Sign-in is via single-use email links; we never store passwords.
GDPR compliance, documented
We are UK-based and ICO-registered. A Data Protection Impact Assessment (DPIA) covering the full data flow has been completed and is reviewed annually. Consultants processing client documents through EMSist can request our Article 28 Data Processing Agreement — email us and we'll send it for review.
No tracking without consent
Analytics load only after you accept the consent banner. We do not sell data, run advertising trackers, or share your documents or results with anyone.
Resilience
Nightly backups are replicated off-site to independent storage, and restore procedures are tested. Production health is monitored continuously with automated alerting.
See also: Privacy policy · How the analysis works · Accuracy & testing