TRUST CENTRE
Public representations contain personal data. The platform is designed so that isolation, erasure and sovereignty are structural properties, not policy promises.
01
Many multi-tenant platforms pool every customer's records into shared tables and separate them with a tenant ID column and a filter. We reject that model. Each authority operates in an entirely separate database namespace, across every layer of the data store.
There is no query, however badly written, that can return another council's data, because the other council's data is not in the same tables to begin with.
ONE NAMESPACE PER COUNCIL
council_a
evidence
intelligence
council_b
evidence
intelligence
Separate namespaces, separate tables, no shared rows. Not a tenant-ID filter.
02
Consultation letters and public representations routinely contain personal data. Because each council's data is segregated in its own namespace, executing a citizen's statutory right-to-erasure request is a clean, definitive database operation, not a high-risk script crawling across global tables shared with other customers.
Your DPO can verify completion, and the deletion cannot touch any other authority's records by construction.
03
The hosting platform maintains zero open ingress ports. All external traffic is mediated through hardened reverse proxies and end-to-end encrypted tunnels, insulating the application stack from public exposure and edge probing.
04
The analysis pipeline supports locally hosted, open-weight inference models alongside secure, contracted cloud endpoints. Sensitive public consultation text is never sent to public, consumer-facing AI products.
Where cloud models are used, they run under enterprise data processing terms: no training on your data, no retention beyond processing.
Request the procurement package: architecture white paper, data processing addendum, security statement, hosting overview, integration guide and procurement FAQ.