Policy Compass is built for teams handling regulated, commercially sensitive work. Here's where your data lives, who can see it, and what we will and won't do with it. Need more for a security review? Our Security Overview has the detail.
Checked against our live systems, October 2026.
Checked against our live systems, October 2026.
We don't use your documents, questions or answers to train models, and the AI models that read your documents don't keep them for training. Every model request runs under Zero Data Retention.
Primary storage is in the UK (London), and the AI models that read your data run in the EU under Zero Data Retention.
AES-256 for stored data, and TLS 1.2+ on every connection - from your browser through to the model providers.
Row-level security ties every record to your organisation, and every request is checked against your membership - so other customers can't reach your data, even with a valid login.
You're the data controller; we're your processor. A signed Data Processing Agreement, with the EU Standard Contractual Clauses and the UK Addendum for restricted transfers, comes with any contract.
Meet George holds the UK government-backed Cyber Essentials certification, covering our technical security controls.
View the certificateHow we use AI
Policy Compass is an AI research tool for specialists. It's designed so you can verify everything it tells you - and to assist your judgement, not replace it.
Research grounds its answers in authoritative regulatory sources - Ofgem, DESNZ, Elexon, the industry codes - and cites where every claim came from, so you can check it against the original.
Different question types trigger different research methods - consultation analysis, code-modification impact, policy review - so the right sources are consulted in the right order, not one generic prompt.
Consultation drafts flag anything a reviewer should check - a quote that couldn't be confirmed word for word, an answer without a verified source - as comments in the Word document.
Like any AI tool, Policy Compass can be wrong. It accelerates research; it does not give legal or compliance advice or replace professional judgement. Verify outputs against the cited sources before acting on them.
Sub-processors
A small set of sub-processors helps us run the service - hosting, AI models, search, email, billing, error monitoring and tracing of AI requests. Some operate outside the UK and EU.
Our Security Overview lists every one, with its purpose, region and safeguards. We share it on request and with any contract, and give active customers at least 30 days' notice of any material change.
Request the Security OverviewNot every team needs these, so they aren't switched on by default. If yours does, talk to us and we'll discuss adding them to your account.
Our Security Overview and Cyber Essentials certificate are available on request.
privacy@policycompass.co.ukNo card, no setup. Your whole team, signed in and ready.
14-day free trial, then £400/month per seat. See pricing
