Security

Security is a first-class product concern at Adviser IQ. Our customers handle sensitive personal and financial data about UK clients; they operate under FCA, ICO, and Consumer Duty obligations. Our job is to make the security side invisible | always on, never compromised.

This page summarises our current technical and organisational security measures. For contractual commitments, see our DPA.

Customer records, documents, fact finds, letters, communications and backups are stored in the United Kingdom (AWS eu-west-2, London).

Some sub-processors process data outside the UK to provide their service. The ones that matter most: AI processing is not UK-only: it runs on AWS Bedrock within the European Union. Requests enter through AWS London and are processed in AWS's EU regions, under UK adequacy regulations; Bedrock keeps nothing and trains on nothing. Anthropic in the United States is solely a last resort — used only when AWS Bedrock is down or failing (every retry has failed), never in normal running; a request sent there is held by Anthropic for a maximum of 30 days and never used for training (UK International Data Transfer Addendum). Text messages go through AWS in London unless your firm has chosen its own dedicated text number, which is provided by ClickSend in Australia (Standard Contractual Clauses with the UK Addendum). Identity/AML checks (Didit), error monitoring (Sentry) and analytics (PostHog) run in the EU, and speech-to-text (Speechmatics, EU) only where a firm switches it on. The sub-processor list is the complete contractual record.

In transit: TLS 1.3 everywhere. HSTS enforced. Minimum TLS 1.2 for legacy clients, with strong cipher-suite policy.

At rest: AES-256 for all customer data in databases, file storage, and backups. Encryption keys managed via AWS KMS with rotation.

Adviser IQ is multi-tenant with strict row-level security (RLS) enforced at the database layer. Every query is scoped to the authenticated firm's firm_id. RLS policies are tested on every deployment. Cross-tenant access is not possible through the application layer.

Password-based auth with Argon2 hashing, mandatory MFA for admin roles, optional MFA for all users. SSO (SAML, OIDC) available on IQ Firm+ tiers. Session lifetimes, IP allowlists, and device checks configurable per firm.

Role-based access control (RBAC) with Principal, Adviser, Admin, Case Manager, Compliance, Read-only roles. Record-level sharing for cases and clients. Permissions auditable via immutable audit log.

Every material user action is logged to an immutable audit vault: logins, data access, data export, record changes, role changes, integration connects. Audit log retention: lifetime of the Subscription + 90 days post-termination export window.

Point-in-time recovery across 30 days. Daily full backups with 30-day rolling retention. Backups encrypted at rest, stored in-region. Disaster recovery runbook tested quarterly. RPO 15 minutes; RTO 4 hours.

Continuous automated security testing: static analysis on every code change, daily authenticated dynamic application scanning, and automated dependency and secret scanning. A third-party, AI-led white box penetration test of our pre-production environment was carried out on 9 November 2026, covering the OWASP Top 10, and every issue identified was fixed and retested. Responsible disclosure at admin@adviseriq.co.uk.

Production access is limited to named individuals on the principle of least privilege and is reviewed under a documented access-review procedure. Adviser IQ does not currently operate DBS checks or a formal annual security-training programme; both are planned as the team grows.

Automated monitoring and alerting (Sentry, Grafana, and external uptime checks) raises incidents automatically. Adviser IQ is a small engineering team, so incident response is best-efforts rather than a staffed 24/7 rota; severity levels and response targets are set out in our incident response plan. Customer notification within 24 hours of a personal-data incident. See Data Breach Response Policy.

Cyber Essentials certified. Adviser IQ Ltd holds NCSC Cyber Essentials certification, assessed against profile v3.3 (Danzell) by Predatech on behalf of IASME. Scope: whole organisation. Certified 04/08/2026, recertification due 04/08/2027. Certificate number f0f4b57e-fbe1-4337-863a-07cb0d56f668.

Also current: ICO registered, UK GDPR compliant. Planned, with no audit or assessment currently booked: Cyber Essentials Plus, SOC 2 Type II, ISO 27001. Standard audit artefacts available on request for evaluation | contact admin@adviseriq.co.uk.

AI prompts are processed by AWS Bedrock within the European Union (entering through AWS London), which retains nothing. The last-resort Anthropic route, used solely when AWS Bedrock is down, holds a request for a maximum of 30 days before deletion. No customer data is used to train third-party models. Internal model usage is logged and auditable. See Disclaimers on AI limitations.

Email admin@adviseriq.co.uk. Acknowledgement within 4 business hours. We work with researchers in good faith; we do not pursue legal action against responsible disclosure.