Trust CentreSecurity, privacy and AI
How WiseBlock looks after the information you trust it with.
WiseBlock protects resident, property and customer information through layered security, privacy and access controls. This Trust Centre explains, in plain language, how we protect information, use AI, manage suppliers and respond to security concerns. It describes what we do today; where something is planned rather than done, it says so.
01Security practices
Layered, so no single control carries it all.
A summary of the controls in place. We don't publish network addresses, software versions or architecture detail here: qualified customers can request more under the documents section.
-
Encrypted in transit
Every connection to WiseBlock uses HTTPS (TLS). Plain HTTP is redirected, and browsers are told to use HTTPS only.
-
Encrypted at rest
The database's storage and its backups are encrypted.
-
Extra encryption for higher-risk information
Residents' and staff members' names, email addresses, phone numbers and addresses, access notes such as key-safe codes, and bank account details are encrypted again, field by field, inside the database. Search works on keyed tokens, so it doesn't need the readable values.
-
Each organisation kept apart
Every record belongs to one customer organisation, and every request is limited to the signed-in user's organisation. One customer can't see another's buildings, residents or money.
-
Role-based access
What each person can see and do is set by their role. Commercial figures are restricted to administrators and can't be granted through roles.
-
A second step at sign-in
Staff sign-in asks for a one-time code as well as the password, for every account, administrators included.
-
Logging and monitoring
Production is monitored for errors and availability, and use of the AI tools is logged with what was sent, by category.
-
Dependencies and vulnerabilities
Code and third-party libraries are scanned automatically for known vulnerabilities and insecure patterns before each release.
-
Backups that are restored, not just taken
Database backups are restored as a test on a regular schedule, so recovery is something we've done, not something we expect to work.
-
Secure development
Every change must pass the full automated test suite and the security scans before it reaches production. Public forms and sign-in pages are protected against bots.
02Privacy and UK GDPR
Whose data it is, and what that makes us.
For the information a managing agent keeps in WiseBlock about its buildings, residents, leaseholders and contractors, WiseBlock generally acts as a processor: the managing agent decides why and how that information is used, and we process it on their instructions.
For our own customers' account, billing and contact details, and for visitors to this website, WiseBlock acts as a controller.
WISEBLOCK LIMITED is registered with the Information Commissioner's Office.
This is a plain-language summary. Our Privacy Notice and your contract with us are what govern.
- Privacy NoticeWhat we collect, why, and the legal basis.Read
- Cookie PolicyEssential cookies only, unless you agree to analytics.Read
- Data retentionHow long information is kept.Read
- Your rights and how to use themAccess, correction, deletion and objection, and where to send a request.Read
- Data Processing AgreementBeing prepared. Ask for it and we'll send it as soon as it's ready.In preparation
- Privacy contactinfo@wiseblock.co.uk, with "Privacy" in the subject.
03Responsible AI
AI drafts and suggests. People decide.
WiseBlock uses AI to read things and draft things: a photo of a fault, a bank statement, a building's email, a question from your team. It doesn't decide anything significant about a resident on its own, and nothing it drafts is saved until a person has looked at it.
-
Minimised before it's sent
The assistant sends residents as a unit and building, not their name, email or phone, unless your question names them.
-
Not used to train models
Anthropic's and OpenAI's business terms don't use what we send through their APIs to train their models.
-
A person in the loop
Repairs, quotes, invoices and payments are approved by people. Residents can ask for a person at any time.
-
Switched on per organisation
Each AI agent is turned on, configured or off by your administrators.
04Hosting and data locations
Where the information lives.
Not just "EU hosted": where each part is kept, and where it can travel.
- Hosting provider
- Hetzner Online GmbH.
- Application and database
- Hetzner data centres in Germany.
- Database backups
- Encrypted, in Germany.
- Files and documents
- Photos, statements, invoices and documents are kept in Hetzner Object Storage in Helsinki, Finland.
- Traffic and protection
- Requests pass through Cloudflare's global network, which protects the site and blocks bots before they reach our servers.
- Outside the UK and EEA
- Some of the services listed under Subprocessors, including the AI and messaging providers, process the information they need in the United States.
Where personal data is processed outside the UK, we rely on the safeguards UK data protection law requires: UK adequacy regulations, the International Data Transfer Addendum, or the UK Extension to the EU–US Data Privacy Framework, depending on the provider.
05Subprocessors
Who else handles the information, and why.
The suppliers that may process customer personal data on our behalf. Some only do so when a customer switches the related feature on.
| Provider | Purpose | Data location | Information processed |
|---|---|---|---|
| Hetzner | Hosting, database, backups and file storage | Germany; files in Finland | All application and customer data |
| Hatchbox | Server deployment and management | United States (administrative access) | Access to the servers above for deploying and maintaining them |
| Cloudflare | Security, bot protection and delivery | Global network | Web requests, IP addresses and form submissions as they pass through |
| Anthropic | AI: the assistant, email triage, reading statements, drafting assessment text | United States | Minimised prompts and the documents a feature is asked to read |
| OpenAI | AI: reading photographs of a repair | United States | Repair photos and the request's description |
| Mistral AI | AI: reading scanned contractor invoices | France | Invoice documents |
| VAPI | The residents' AI receptionist, by chat and voice | United States | The resident's conversation with the receptionist |
| Twilio | Text messages, phone calls and sign-in codes | United States | Phone numbers and message content |
| Zernio | WhatsApp messages, through Meta's WhatsApp Business service | Outside the UK | Phone numbers and message content |
| Mailgun | Sending email and building mailboxes | United States | Names, email addresses, message content and metadata |
| Expo | Notifications to the mobile app | United States | Device tokens and notification text |
| Gamma | Laying out generated reports | United States | The content of the report being laid out |
| Yapily | Open Banking connection (when switched on) | United Kingdom | Bank statement lines and balances, read-only |
| Intuit QuickBooks | Accounting (when a customer connects it) | United States | Supplier details and approved bills |
Mailboxes your team connects (Microsoft 365, Google) are your own accounts, used at your instruction. Website-only services, such as analytics after consent and demo booking, don't receive customer data.
06Certifications and testing
Independent assurance: where we are.
WiseBlock doesn't yet hold an independent security certification, such as Cyber Essentials or ISO 27001, and hasn't yet had an external penetration test.
When it does, the certificate, its scope and the month of the test will be listed here. Nothing will be shown before it's real, and no badge appears on this site for anything still in progress.
07Service reliability
Built to keep running, and to recover.
A high-level view of how the service stays available and what happens when something goes wrong.
-
A live status page
Whether each part of WiseBlock is working, at wiseblock.co.uk/status. Availability history will be published there once there's enough of it to be meaningful.
-
No single web server
WiseBlock runs on more than one web server behind a load balancer, with the database on its own server.
-
Backups and restores
The database is backed up and encrypted, and backups are restored as a test on a regular schedule.
-
Telling you when something happens
If an incident affects your service or your data, we tell your organisation's administrators by email. A personal data breach is handled under UK GDPR, including telling the ICO within 72 hours where the law requires.
08Documents
What's public, and what's on request.
- Security overviewThis page.
- Privacy NoticeHow we handle personal data.Read
- Cookie PolicyThe cookies this site uses.Read
- Responsible AI statementHow and where AI is used.Read
- Subprocessor listAbove, on this page.View
- Vulnerability disclosure policyHow to report a security issue.Read
- Data Processing Agreement templateBeing prepared.In preparation
On request, for prospective customers
Some detail is shared only with organisations evaluating WiseBlock, under confidentiality: internal security policies, infrastructure detail, disaster-recovery arrangements, and answers to your security questionnaire. Penetration-test reports and audit evidence will be added here once they exist.
Request security documents09Security and privacy contacts
Tell us, and we'll act on it.
For a security concern or a privacy question, write to us directly.
- Security
- info@wiseblock.co.uk, with "Security" in the subject. To report a vulnerability, please read the disclosure policy first.
- Privacy
- info@wiseblock.co.uk, with "Privacy" in the subject, including requests about your personal data.
Related
Next step
Questions from your security team? Bring them to the demo.
A 30-minute demo on a portfolio like yours: fire safety, repairs, residents and service charges, with the agents switched on.