Security, data protection and AI

All application data, documents and logs are stored at Amazon Web Services in Frankfurt, Germany (region eu-central-1). Database backups are copied to AWS in Ireland (eu-west-1), for when Frankfurt as a whole is unavailable. The AI check runs through Amazon Bedrock in AWS regions inside the EU only.

Data is in the European Economic Area, not the United Kingdom. Hosting in the AWS London region (eu-west-2) is on the roadmap and not available yet.

• Applicants and agents see only their own applications, and the people they invite only what they were invited to.
• Your council’s officers see the applications made to your council; an administrator can limit an officer to certain application types.
• Every council is a separate organisation. Every request is checked on the server against the viewer’s organisation and role; files are only served through the application after that check. The separation is logical: councils share one database and one storage bucket.
• Our support staff can look inside a council’s account read-only, for at most 2 hours at a time; each time is logged and alerted. Platform administration needs a second factor in every session.

• In transit: HTTPS only, with HSTS for a year including subdomains. Calls to AWS services (storage, AI, email) also use TLS.
• At rest: the database on an encrypted disk (AES-256), documents in Amazon S3 with AES-256 and public access blocked, keys managed by AWS KMS. A SHA-256 fingerprint is kept for every file.
• Uploads are opened in an isolated container without internet access, without AWS credentials and with a read-only file system.

• Applicants log in with a 6-digit code sent by email: valid for 15 minutes, used once, 5 tries.
• Passkeys (WebAuthn), which are resistant to phishing.
• Microsoft Entra ID for council staff, set up for your own tenant, with sessions of at most 12 hours.
• Your administrator can require a passkey or Entra ID for all officers. A new device or passkey on an account triggers an email to its owner.
• Rate limits per account and per network address, with alerts.

Each application and organisation has an audit log: who submitted, checked, decided, viewed or downloaded what, and when. Network addresses of logins and administrative actions are kept for 90 days. Your administrator can export the log. AWS activity is recorded in CloudTrail and application logs in CloudWatch, each kept for a year.

ValidFirst is not your planning record: export each case into your back office, where your own retention schedule applies. At the end of a contract your administrator can export all data in one zip; we delete all council data 30 days after the end date and confirm it in writing.

The database is backed up every hour (kept 2 days) and every day (kept 35 days) to a separate storage bucket with Object Lock: the server can add backups but cannot read or delete them. A copy is kept in Ireland. Deleted or overwritten files can be recovered for 30 days. Restoring needs a separate role with multi-factor authentication, for at most an hour.

Targets: at most 1 hour of database changes lost, files none; service back within 4 hours. We test a full restore every quarter, comparing tables, row counts, relations and indexes with live. The last test, on 14 November 2026, passed.

Not sub-processors: planning.data.gov.uk receives only the site location, to return the constraints there. GitHub holds our source code and no council data. We give councils at least 30 days’ notice of any new or replaced sub-processor.

For applications made to your council, your council is the controller and we are its processor under UK GDPR Article 28. The lawful basis is the council’s public task as local planning authority (Article 6(1)(e)). We process data only on your instructions, never for our own purposes, and assist with data subject requests, DPIAs and breaches. We notify you of a personal data breach within 24 hours of becoming aware of it.

For our own website, the pilot form and guest trials, we are the controller. See the privacy notice.

Personal data goes from the UK to Germany and Ireland. These transfers rely on the UK’s adequacy regulations for the EEA (Data Protection Act 2018, section 17A and Schedule 21). If they stopped covering a destination, we would put the International Data Transfer Agreement or the UK Addendum in place before continuing, and tell you.

AWS and Sentry are owned by US companies. No data is sent to the US by design, but US law (the CLOUD Act) can in principle require a US parent company to produce data it controls. The draft DPIA covers this risk for your DPO to weigh.

Model and provider. Claude, made by Anthropic, through Amazon Bedrock with EU inference profiles only; the production code refuses any other route. Bedrock model invocation logging is off. As an option per council, Mistral models from Mistral AI in Paris; if that provider is unavailable, the check stops rather than fall back to another. The model used is recorded with every check.

No automated decisions. The validation decision is taken by your officer, who judges each finding before a letter is drafted, with the evidence in view. No decision is based solely on automated processing, so UK GDPR Article 22 is not engaged. Site constraints come from planning.data.gov.uk datasets and permitted-development signals from fixed code, not from the AI.

Accuracy. Every finding is set against your officer’s decision. The measurement page shows how often the check agreed, what it missed and what it was too strict about. Changes to instructions are tested against a fixed set of example documents with known faults before release.

Transparency. We provide a draft record in the Algorithmic Transparency Recording Standard (template v4.0) for your council to complete and publish. ATRS is recommended for local government, not mandatory.

We aim for WCAG 2.2 level AA. Automated accessibility tests (axe-core) run during development and fail on any critical or serious issue; council colours are kept at a contrast of at least 4.5:1. An independent manual audit has not been done yet. Read the accessibility statement.

Found a security problem? Our contact details are in /.well-known/security.txt. We respond within 5 working days. Please don’t access other people’s data or disrupt the service while testing.

Said up front, so you can record it in your risk assessment:

• No Cyber Essentials or Cyber Essentials Plus certificate. Cyber Essentials is planned before the first paid contract.
• No ISO 27001 certificate or SOC 2 report. We use ISO 27001:2022 as a guide. AWS’s own certifications cover the underlying cloud only.
• No independent penetration test yet. Planned before a council goes live with real applicants, then yearly.
• Uploaded files are not scanned for malware; they are opened in an isolated container without network access.
• A web application firewall in front of the service is being set up.
• Data is hosted in the EEA, not the UK. UK hosting is on the roadmap.
• One production server, without a hot standby: recovery is from backup, within 4 hours.
• Some administrative access to AWS still uses a long-lived key; moving to single sign-on with short-lived credentials is planned.
• A small team: no 24/7 on-call rota and no formal information security management system.
• Not on G-Cloud or the Digital Planning Directory yet. No UK council is live yet.
• The European-only AI option (Mistral) needs its data retention settled before a council can use it.

These are drafts for your teams to check and complete; we send them on request and go through them on a call.

• Data Protection Impact Assessment, pre-filled in the ICO’s structure, for your DPO
• Data processing agreement (UK GDPR Article 28) with sub-processors and security measures
• Security statement against the NCSC Cloud Security Principles and the Cyber Essentials control themes
• ATRS record, written for your council to publish
• AI and the law: Article 22, the Equality Act 2010 and the DMPO 2015
• Accessibility statement for your council to publish
• Procurement routes and a one-page pilot proposal

Ask at hello@validfirst.co.uk.