Trust and security
Testing your AI should never create a new risk.
How we protect your systems, your data and our findings during an assessment.
How we work
Isolated test environments
Each engagement runs in its own environment. Test data, results and evidence for one client are never accessible to another.
Encryption
Data is encrypted in transit and at rest. Connections to your systems use TLS, and stored evidence is encrypted using industry-standard methods.
Least access
We test your AI through the same interfaces your users have, wherever possible. We only ask for deeper access when a test needs it, and agree it with you first.
Your data stays yours
We never use your data, prompts or results to train models. Findings are shared only with the people you name.
You keep the tests
At the end of an assessment you receive the full test suite and evidence pack, so you are never dependent on us to re-run them.
Controlled, logged access
Only the named assessors on your engagement can access your environment. Every access is logged.
Data handling
- What does FireBreak need access to?
- Usually a test account on the AI system being assessed, its documentation, and examples of the questions or tasks it handles. For agents, we also need to know which tools and systems it can reach. We agree the scope in writing before any testing begins.
- Do you test against live customer data?
- Not by default. We prefer a test or staging environment with realistic but non-personal data. Where live testing is needed, we agree limits with you in advance and never take actions that change real records without approval.
- How long do you keep data?
- Only for the length of the engagement and any agreed re-testing period. After that we delete it, and confirm in writing. You can request deletion at any time.
- Do you use sub-processors?
- A small number, for secure infrastructure. All are bound by contract to equivalent security and data-protection standards. A list is available on request.
Compliance
- We operate in line with UK GDPR and EU GDPR.
- We sign Data Processing Agreements and NDAs before any access is granted.
- We complete security questionnaires as part of your procurement process.
- FireBreak was the first external company on the Scottish Government's AI Register.
Security questions?
We can share our security documentation and talk your team through how an assessment would work.
This page describes our general approach. It is not a legal agreement or warranty. Specific terms are set out in your contract with FireBreak.