Security, compliance & responsible AI.
How Ada Create protects your data, meets your compliance obligations and uses AI under control.
[ CERTIFIED ]
Certified, accountable and built by us.
ISO/IEC 27001
Certificate 123209, issued by Prescient Security, valid to 25 March 2029. Scope covers the development of the platform, its operation and service delivery.
No breach in the last three years.
- One accountable entity — The company that holds the certification is the one that signs your contract: PersuasionXP Limited, trading as Ada Create.
- Our own platform, built in the UK — We developed and own Ada Create — not an agency layer on third-party tools. Development and support are UK-based.
- Monitored continuously — Automated cloud monitoring via Vanta, weekly vulnerability scanning, annual surveillance audits and independent penetration testing.
Your data: minimal, UK-hosted and protected.
Only what’s needed
Public professional sources — no sensitive data, no data brokers, no paid enrichment, and no AI model training.
Stored in the UK
Hosted on AWS in London, with encrypted backups held in the EU for disaster recovery.
Encrypted throughout
AES-256 at rest via AWS KMS, TLS 1.2+ in transit, and keys managed to NIST SP 800-57.
Isolated and segregated
Tenant isolation at the API layer; production kept physically separate from test and dev.
Access on need-to-know
Least-privilege, role-based access with documented approval, MFA, and trained, vetted staff.
Logged and auditable
Centralised, append-only, encrypted logs with a tamper-evident audit trail in AWS CloudTrail.
Your data never trains AI models.
Enterprise providers only
Anthropic, OpenAI, Google Gemini and Perplexity via enterprise APIs, under no-training terms with minimal or zero retention.
Humans stay in control
Ada is advisory: it never sends, publishes or decides. Every output is reviewed and approved by your team.
Change-controlled models
New model versions are tested in staging against our guardrails before they reach clients — never silently updated.
No shortcuts on controls
The AI layer is segregated and covered by our ISO 27001 ISMS, with the same isolation, encryption and logging.
What we commit to, and the proof.
In your contract
- Data Processing Agreement — you control, we process
- Full technical support for your DPIA
- Sub-processor list, with advance notice of changes
- Incident notification, ICO within 72 hours where applicable
- Defined retention and deletion at end of engagement
Available on request
- ISO 27001 certificate and scope statement
- Penetration test summary and remediation record
- Statement of Applicability and policy set (NDA)
- Generative AI Acceptable Use Policy
- Cyber and privacy insurance certificate
