---
title: Trust Centre
seo_title: Advise Trust Centre | Security, hosting, AI governance and privacy
description: How Advise protects your data. Encryption, isolated environments, access control, AI governance, incident response, retention and our DPA.
slug: /trust
template: standard
cta_primary: { label: Request the security pack and DPA, href: "mailto:security@advisecpg.com?subject=Security%20pack%20and%20DPA%20request" }
cta_secondary: { label: How the Advise Engine works, href: "/engine" }
schema: WebPage + FAQPage
---

# Trust Centre

Brand owners give us their most commercially sensitive data. This page sets out how it is protected, who can see it, and how the AI is kept on a short leash. Advise has operated as an EU data processor under the GDPR for years, so documented controls are how we work every day.

## Your own environment

- **Every client gets a dedicated environment and data model.** There is no shared data store, no cross-client query is possible, and isolation between clients is absolute. Multi-market clients can run one deployment per country, linked under a single environment.
- **Advise Cloud** runs on Microsoft Azure in Advise's tenancy, in a dedicated environment in your chosen region. The region is fixed per deployment and written into your agreement. Processing outside the EU/EEA, for example for a US business, happens only with your prior written approval.
- **Advise Private** runs in **your own cloud tenancy**. You own the data, the keys and the install. [Talk to us](/contact)
- All processing stays in your region, including AI inference and backups. This is a hard architectural constraint, not a policy preference.
- **Your data is used for one purpose: your Advise platform.** It is never sold, never used for our own benefit, and never used to train AI.
- **Licensed data stays within your licence.** We work inside the agreements you hold with syndicated and panel data providers, and we're an onboarded data processing vendor with many of the major CPG data providers.

## Encryption

- **At rest:** AES-256, including backups
- **In transit:** TLS 1.2 or higher
- **Keys:** managed through Azure's key management service
- **Passwords:** hashed and salted. The original text is never stored.

## Access control

- **Role-based access** down to metric level: people see only the retailers, categories and measures their role allows.
- **Your admins are in control.** They invite users, set roles and scope access themselves, and the usage report shows who is using what, by module.
- **Single sign-on** with your identity provider (for example Microsoft Entra ID), so your own MFA and conditional-access policies apply. Two-factor authentication is available with or without SSO.
- **Advise staff** reach your environment only with explicit authorisation and a documented support reason, and every access is logged. On Advise Private, they need your approval first.
- **We never connect to your systems.** Support happens inside the Advise environment, with no remote access to anything of yours.

## How we build and ship

- Automated static code scanning, security linting and dependency vulnerability scanning in the development pipeline
- Peer review of every change. Security defects are fixed before release, without exception.
- Versioned platform releases about monthly, fully tested. Security fixes ship out of cycle.
- **Your live data stays in your environment.** It is never copied to development or test. We build and test on synthetic data.
- Independent third-party security reviews of the platform, including its AI components. Summaries are available under NDA.
- You can run your own penetration test on your environment, by prior agreement.
- Every member of staff completes security and data-protection training at induction and signs a confidentiality declaration.

## Resilience and incidents

- Automated, encrypted, in-region backups, with restores tested in practice
- **Recovery point:** no data loss. Every analysis is derived from retained source data, so an environment can be rebuilt in full.
- **Recovery time:** 24 hours at most, and usually far faster
- **Breach notification:** unauthorised access to your data, or any personal-data breach, is notified without undue delay and within 24 hours. Other material incidents are notified within 72 hours, with a written report within 5 working days.

## AI governance

- The AI in the Intelligence and Autonomous layers uses a private Microsoft Azure OpenAI instance, served within your data region, and only where you've enabled it.
- Your data never trains any model.
- The AI reaches data only through the governed **Function Registry**. It never runs raw queries, and Core computes every number.
- The AI works inside the same role-based access as the person using it. It is not a route around access controls.
- Autonomous prepares work and never sends anything on its own. A person always decides and sends.

[AI governance in detail](/ai#governance)

## Your data, your rights

- You own your data and everything derived from it. Full export in standard formats is built in, during the contract and at exit.
- Data stays live for the length of your licence. Logs are kept for the same period, under the same protection.
- **On exit:** permanent erasure from active systems within 30 days, backups expire on standard rotation, and we confirm deletion in writing.
- We sign a Data Processing Agreement with every client. It includes your audit rights.
- **Microsoft Azure is our only subprocessor for client data.** We give 60 days' notice of any change, with a right to object. [Subprocessors](/trust/subprocessors)

## Infrastructure

Advise runs entirely on Microsoft Azure. Azure's hosting-level certifications include ISO 27001, 27017 and 27018, and SOC 1, 2 and 3.

## Security pack

| Document | Availability |
|---|---|
| Data Security and Governance Overview | Now |
| Responsible AI Policy | Now |
| AI Assurance Pack | Now |
| Data Processing Agreement | Now |
| Incident Response Summary | Now |
| Architecture walkthrough | On request |
| Security questionnaire completion | On request |
| Third-party security assessment summaries | On request, under NDA |

[Request the security pack and DPA](mailto:security@advisecpg.com?subject=Security%20pack%20and%20DPA%20request)

## Report a vulnerability

Email security@advisecpg.com. You'll reach our security team directly.

[Privacy Statement](/privacy) · [Subprocessors](/trust/subprocessors)