Data and security policy.

Purpose and scope

The Leadership Insight Platform presents assessment insight produced by Tribus Advisory, including material previously delivered as PDF reports, in a secure digital environment where authorised users can search, compare and interrogate it. This policy covers all assessment data held on the platform.

How data is used

We use assessment data only to:

• present insight already delivered to the client in a digital, interactive format;
• enable authorised users to search, filter, compare and interrogate that insight, including by asking Ask the Report, the platform's AI assistant;
• gather survey responses for 100-day and later reviews from the people the client asks to take part;
• support the client in applying the insight to leadership, hiring, development and value creation decisions;
• provide platform support, maintenance, security and continuity.

We never use one client's assessment data to deliver services to another client, and we never sell, license or otherwise make it available to third parties other than the sub-processors listed below.

Portfolio insight, where enabled, compares only a single client's own engagements, for that client. Any anonymised analysis across clients requires each client's written permission and appropriate safeguards.

Ownership and roles

Clients retain ownership of their own confidential information and the data they provide to us. Tribus Advisory retains ownership of its methodology and intellectual property, including competency frameworks, assessment methodology, report structures, scoring approaches and the platform itself.

We comply with the UK GDPR and the Data Protection Act 2018. Tribus Advisory acts as controller for the participant data it collects under its own privacy notice, and each client acts as controller for its own use of assessment data. Our technology partner, Kyln Digital Ltd (SC869140), develops, administers and supports the platform solely as a processor on our documented instructions. It owns none of the data, and administers the production infrastructure on Tribus Advisory's behalf.

Hosting and residency

Application hosting

Vercel Inc., in London

Database

Neon Postgres, hosted on AWS in London (eu-west-2)

Image storage

Vercel Blob Storage, in London, for profile photographs and logos

Data residency

The platform runs, and stores assessment data, in the United Kingdom. The exceptions are Ask the Report, which sends questions and the relevant report content to AI model providers in the United States; email, including sign-in codes and survey invitations, which Resend delivers from the European Union; and technical error reports, which Sentry stores in the European Union. Any other transfer outside the UK needs the client's prior written agreement and appropriate safeguards.

Changes

Clients receive at least 30 days' written notice of any change to hosting arrangements or sub-processors.

Security measures

Encryption in transit

TLS 1.2 or above, with HTTPS for all traffic and database connections over TLS

Encryption at rest

AES-256

Authentication

Tribus staff sign in to named individual accounts with a password, and optional multi-factor authentication with an authenticator app is being added. Client users sign in with a one-time code sent to their own email address, valid for ten minutes, and see only the engagements they have been granted, which can be revoked at any time. There are no shared credentials.

Access and audit logging

The platform records each client user's sign-ins and the report sections they open, and keeps an audit trail of the changes Tribus staff make to reports and access, alongside infrastructure request logs and error monitoring.

Environments

Development and production are separated, and live assessment data is never used in test environments.

Backups

Continuous backup of the database, with point-in-time restore, a recovery window of at least seven days, and restore procedures tested on a scheduled basis.

Testing and patching

Ongoing automated dependency and vulnerability scanning, routine security patching, and an independent penetration test before go-live. Clients may commission their own.

Certifications

Our infrastructure providers, Vercel and Neon on AWS, maintain SOC 2 Type II and ISO 27001.

Artificial intelligence

Ask the Report answers authorised users' questions about a report. Each question, the recent conversation and the relevant report content go through the Vercel AI Gateway to OpenAI, or to Anthropic if OpenAI is unavailable, both in the United States. The gateway sends requests only to providers with zero-data-retention agreements that do not train their models on the information, so assessment data is never used to train any third-party model. Answers are generated automatically and are not checked by Tribus before they are shown. Tribus assessors remain responsible for all assessment judgements and recommendations.

Each saved Ask the Report question and answer expires after 90 days and is then excluded from the platform and AI conversation history. An hourly cleanup removes expired content from the live database. Users can clear their conversations earlier at any time. Conversations are available only to the relevant authorised user. This does not delete the underlying assessment data or reports. Backup copies expire on their normal cycle.

Access control

Access to a client's assessment data is limited to authorised users nominated in writing by the client, and to the Tribus and technology partner personnel who need it to deliver, support and secure the platform. When a client tells us an authorised user no longer needs access, we remove it within one business day.

Retention and removal

• Assessment data is kept for the duration of the platform subscription.
• On termination, data is removed from the live platform and securely deleted within 30 days, with residual copies in secure backups expiring on their normal cycle. We confirm removal in writing.
• Clients can request a copy of their assessment data, in its original PDF form and, where available, as a structured export.
• Clients can ask us to remove an individual participant's data at any time, and we will do so within 30 days unless we are required to retain it for legal or regulatory reasons.

Breach notification

If a personal data breach affects a client's assessment data, we will notify the client without undue delay and in any event within 72 hours of becoming aware of it, in line with UK GDPR. We will set out the nature of the breach, its likely consequences, the categories and approximate number of individuals affected, and the steps taken or proposed, and we will work with the client on any notification to the Information Commissioner's Office or to affected individuals.

Sub-processors

Vercel Inc.

Application hosting in London, image storage and AI Gateway

Neon

Database hosting and sign-in, on AWS in the UK

OpenAI

AI model provider, via the AI Gateway, in the United States

Anthropic

Fallback AI model provider, via the AI Gateway, in the United States

Resend

Email delivery, including sign-in codes and survey invitations, in the European Union (Ireland)

Sentry

Technical error monitoring in the European Union (Germany). Session replay is disabled.

GitHub

Source code hosting

Kyln Digital Ltd (SC869140)

Platform development, administration and support, as processor

Contact

For questions about this policy, contact David Chamberlain (DC@tribusadvisory.co.uk) or Jeremy Lowen (JL@tribusadvisory.co.uk). Security incidents can also be reported to security@kyln.digital.

Tribus Advisory Limited, registered in England and Wales, company number 16774192. This policy is governed by the laws of England and Wales.