Security

Security is a first-class product concern at Adviser IQ. Our customers handle sensitive personal and financial data about UK clients; they operate under FCA, ICO, and Consumer Duty obligations. Our job is to make the security side invisible — always on, never compromised.

This page summarises our current technical and organisational security measures. For contractual commitments, see our DPA.

All customer data is stored within the United Kingdom (AWS eu-west-2, London). No customer personal data leaves the UK for storage or processing. Sub-processors with incidental access (AI model providers) operate under UK/EU-adequate DPAs with zero-retention terms.

In transit: TLS 1.3 everywhere. HSTS enforced. Minimum TLS 1.2 for legacy clients, with strong cipher-suite policy.

At rest: AES-256 for all customer data in databases, file storage, and backups. Encryption keys managed via AWS KMS with rotation.

Adviser IQ is multi-tenant with strict row-level security (RLS) enforced at the database layer. Every query is scoped to the authenticated firm's firm_id. RLS policies are tested on every deployment. Cross-tenant access is not possible through the application layer.

Password-based auth with Argon2 hashing, WebAuthn/passkey support, mandatory MFA for admin roles, optional MFA for all users. SSO (SAML, OIDC) available on IQ Firm+ tiers. Session lifetimes, IP allowlists, and device checks configurable per firm.

Role-based access control (RBAC) with Principal, Adviser, Admin, Case Manager, Compliance, Read-only roles. Record-level sharing for cases and clients. Permissions auditable via immutable audit log.

Every material user action is logged to an immutable audit vault: logins, data access, data export, record changes, role changes, integration connects. Audit log retention: lifetime of the Subscription + 90 days post-termination export window.

Point-in-time recovery across 30 days. Daily full backups with 30-day rolling retention. Backups encrypted at rest, stored in-region. Disaster recovery runbook tested quarterly. RPO 15 minutes; RTO 4 hours.

Continuous automated security testing: static analysis on every code change, daily authenticated dynamic application scanning, and automated dependency and secret scanning. An independent third-party penetration test is planned and has not yet been commissioned. Responsible disclosure at admin@adviseriq.co.uk.

Production access is limited to named individuals on the principle of least privilege and is reviewed under a documented access-review procedure. Adviser IQ does not currently operate DBS checks or a formal annual security-training programme; both are planned as the team grows.

Automated monitoring and alerting (Sentry, Grafana, and external uptime checks) raises incidents automatically. Adviser IQ is a small engineering team, so incident response is best-efforts rather than a staffed 24/7 rota; severity levels and response targets are set out in our incident response plan. Customer notification within 24 hours of a personal-data incident. See Data Breach Response Policy.

Cyber Essentials certified. Adviser IQ Ltd holds NCSC Cyber Essentials certification, assessed against profile v3.3 (Danzell) by Predatech on behalf of IASME. Scope: whole organisation. Certified 04/08/2026, recertification due 04/08/2027. Certificate number f0f4b57e-fbe1-4337-863a-07cb0d56f668.

Also current: ICO registered, UK GDPR compliant. Planned, with no audit or assessment currently booked: Cyber Essentials Plus, SOC 2 Type II, ISO 27001. Standard audit artefacts available on request for evaluation — contact admin@adviseriq.co.uk.

AI prompts are processed via provider DPAs with zero-retention configurations. No customer data is used to train third-party models. Internal model usage is logged and auditable. See Disclaimers on AI limitations.

Email admin@adviseriq.co.uk. Acknowledgement within 4 business hours. We work with researchers in good faith; we do not pursue legal action against responsible disclosure.