Last updated: · Version 1.1
These are the requirements for our Discovery engagements, not a claim that every described software capability is already operational. Scope, permissions, providers and retention must be agreed and checked before client evidence is processed.
Start with the question and the minimum evidence
Discovery may examine business documents, operational datasets, system exports, policies, authorised interview material, workflow observations, financial metrics and technical information. The agreed scope determines what is relevant.
We consider extracts, redaction and aggregation before requesting a wider dataset. Do not send credentials, personal records or confidential business files through the initial website enquiry form.
Make uncertainty visible
Source content, interview claims, observations, measurements and independently verified findings are different kinds of evidence. They must remain distinguishable from assumptions, uncertainty and contradictory accounts.
Original evidence must not be silently rewritten to fit a conclusion. Corrections and superseding evidence should preserve an intelligible history for as long as that history can lawfully and contractually be retained.
Choose processing routes for the information
An engagement may need specialist providers for AI analysis, transcription, hosting, storage, document processing, communications or security. Not every provider is suitable for every source.
Before use, the actual providers, access, processing locations, retention and relevant data-use conditions must be checked and documented. Sensitive information may need exclusion, redaction, restricted access or an approved private or local route. This is not a promise that all data stays local.
The production Discovery provider list is not yet confirmed. Provider approval, any required client authorisation and applicable data-processing terms are prerequisites to sending client evidence to those services.
International processing
Some providers may process information outside the UK. The engagement review must establish whether a restricted international transfer occurs and what applicable adequacy arrangement, safeguard or other lawful mechanism is required before it proceeds.
Stricter residency requirements can rule out a processing route. A location claim on this website cannot substitute for checking the actual provider and engagement configuration.
Controls proportionate to the risk
The required safeguards depend on the sensitivity and risks of the information. Access permissions, approved processing routes, safe presentation outputs and retention controls must be checked for the engagement.
These principles are not a security certification or a guarantee that a system cannot be breached. Specific implemented controls and any evidence a client needs to assess them must be established during scoping.