Data & AI trust
Where Your Client Data Goes When You Use AI: A Straight Answer
Jon Livsey · · 6 min read
Short answer: your client documents are stored in AWS London, in eu-west-2. Two processors work outside the UK — speech-to-text in the EEA, and the AI model that drafts your letters, Anthropic's Claude, in the US under Standard Contractual Clauses and the UK Addendum. We don't train foundation models on your data. Every one of those facts is in our Data Processing Agreement, not just on a landing page.
I'm writing this because I'd want it before I trusted a vendor with client files, and most AI-for-advisers marketing doesn't go this far. It says "secure" and "UK-based" and moves on. A compliance-trained sceptic doesn't want adjectives. You want the routing.
Where the file actually sits
Client files, fact-finds, meeting notes and CFRs are stored in Amazon S3 in AWS's eu-west-2 region — London. The application itself, and the database that holds your client records, run on Railway. Data at rest is encrypted with AES-256; data in transit uses TLS 1.3. Those two lines are contractual commitments in the DPA, not aspirations.
Who else touches it, and why
Nobody serious runs everything on one server, and a vendor who claims to is either lying or hasn't scaled. What matters is which processors touch your clients' data, what each one does with it, and where it goes. Ours is a short, named list.
| Sub-processor | What it does with the data | Location | Safeguard |
|---|---|---|---|
| Railway | Application hosting and the primary database | See note below | See note below |
| Amazon Web Services | Document storage (S3) and encryption keys (KMS) | UK (eu-west-2) | UK data residency |
| Anthropic (Claude) | Reads extracted data to draft agendas, notes and letters | US | SCCs + UK Addendum |
| Speechmatics | Converts meeting recordings to text | EEA | UK adequacy regulations; Article 28 agreement outstanding — see the DPA |
| Stripe | Payment processing | UK/EU | Contract billing only, not client files |
| DocuSign | Contract e-signatures | EU | Contract execution only, not client files |
Read that table literally. Two rows are firm-wide infrastructure and never see a client file at all. Two of the remaining four process outside the UK: speech-to-text in the EEA, and the AI model doing the drafting in the US.
Two corrections to an earlier version of this post, because the point of writing it was to be checkable.
It listed AWS Transcribe as the speech-to-text engine, in London. That is no longer what runs: Speechmatics replaced it, and Speechmatics offers no UK processing region — its published regions are the EEA, the US and Australia. Our systems refuse to send audio unless the endpoint is pinned to an EEA region, so processing happens in the EEA rather than the UK. The UK has made adequacy regulations covering the EEA, so that transfer needs no additional safeguard, but it is a transfer and this post previously said there wasn't one.
It also said the primary database sat in the same London region as the documents. It does not — the application and the database run on Railway, which is a separate provider with its own regions. Our DPA's sub-processor table is the document that governs where data is processed, and it does not currently state a hosting region or the data-processing terms we hold with Railway. Until it does, treat any claim about that region — including one you might read on our own site — as unverified. Documents in S3 are unaffected: those are in London.
The ones that leave the UK
When Claude drafts a suitability letter or meeting note, the extracted text it works from is processed on Anthropic's infrastructure in the US. That's a genuine international transfer, and we don't dress it up as anything else. It's covered by Standard Contractual Clauses plus the UK Addendum, which is the same mechanism most UK firms already rely on for any US-based software they use, and we've documented supplementary measures alongside it, per the DPA.
Meeting audio takes a shorter trip, to the EEA, covered by UK adequacy rather than by clauses.
If a vendor tells you their AI runs "in the UK" without naming which model and where it actually executes, ask again. Most AI-for-advisers tools in this market use a foundation model hosted outside the UK somewhere in their stack. The honest answer is naming it, not implying it doesn't happen.
Training is a specific claim, not a vague one
"We don't use your data" is marketing. The precise version is on our FAQ: we don't train foundation models on customer data. That's the claim we'll stand behind, and it's the one worth holding any vendor to — ask them exactly that sentence, not "is my data safe," and see how directly they answer.
How long, and why that's not our call
Your firm decides, and we carry it out. You are the controller for your client data; Suitable is the processor, holding it on your instruction. So the retention period is yours to set, not a number we picked for you — you configure a retention floor for your own firm, an erasure instruction is carried out once that floor has elapsed, and if you set no floor, erasure runs when you ask for it.
That shape is the point, and it's why you shouldn't accept a single uniform figure from any vendor, us included. Real record-keeping obligations vary by product and by advice type, and for some pension work they don't expire at all. A vendor quoting one number that covers every client and every plan is describing their own storage policy, not your obligations. What we commit to is in the Privacy Policy and the DPA; what you must keep, and for how long, stays yours.
What stops one firm seeing another's
Every query in the platform is filtered by organisation. That's not a design intention — it's enforced in the data access layer, and it's proven by dozens of dedicated automated tests, one file per data domain (pensions, protection, income, health, family and more), whose entire job is confirming that cross-organisation access is blocked. It's tedious to build and boring to describe, which is exactly why it's a better signal than a vendor telling you their platform is "enterprise-grade."
My opinion
Trust and security due diligence should be answerable with a file path and a contract clause, not a reassurance. If a vendor can't tell you which AI model touches your data, where it runs, or how long a record survives, that's the same category of gap as weak access controls — it just doesn't show up in a security scan.
What this post doesn't cover
Registration and certification status — ICO registration, any security certifications — move independently of this post and I'm not going to let a blog entry go stale on your behalf. Check the live Privacy Policy and DPA for the current position; they're the source of truth, this article is just the map.
If you want the underlying documents rather than my summary of them, they're linked above, and a full sub-processor list and DPA are available on request — get in touch through getsuitable.co.uk.