Written for the person who has to sign this off.

Who is responsible for what

Your firm is the controller: it decides what is held about your client families and is responsible for it. Independent Check is the processor, handling that information only to run the service and only on your instructions. Lawful basis, privacy notices and client consent sit with your firm, and we supply the facts you need to write them.

Only what is needed is collected

There is no marketing profile, no tracking across other websites, and nothing collected just in case. Dates of birth are recorded only where a family gives them, because inheritance tax allowances depend on who is a direct descendant. Relatives who never log in appear only as names in the family tree, for the same reason. Usage is recorded by role, never by named person.

Where the data lives

One server, in Germany. Nothing is duplicated to another country or another provider. Because the server sits in the European Economic Area rather than the UK, this is a transfer of personal data outside the UK. It is a permitted one that needs no extra paperwork, because the UK formally recognises the EEA as providing adequate protection. If your policy is that client information must never leave your own infrastructure, the same software runs there instead, with nothing lost.

Separation, access and encryption

Each firm’s information sits in its own database, not one shared database with a column marking who owns each row, so a query run for your firm cannot return another firm’s records. A single piece of code answers every question about what a person is allowed to do, and every page asks it. All traffic uses HTTPS, and uploaded documents are encrypted before they are written to disk.

Nobody sets a password

There is no password store to be stolen, and no password to be reused or guessed. People sign in with a single-use link sent to their email, or with their own device using Face ID, a fingerprint or a PIN.

What the AI sees, and what happens to it

Exactly one part of the product contacts an AI service, and it uses Claude, made by Anthropic. There is no other AI provider and no other route by which family information leaves our systems. Your clients’ information is not used to train AI models: the Hub uses Anthropic’s commercial API, whose published terms state that customer inputs and outputs are not used for training. The assistant is only ever given the information the person asking is already allowed to see.

Export, erasure and subject access

A family’s whole Hub, including the audit trail and every stored file, downloads as a single zip in a plain, readable format. It is the same file whether you are answering a subject access request or moving away from us. Deleting a family requires an adviser to type the family’s name, and then removes the records and the files. For any subject access request or data protection question, write to info@independentcheck.co.uk and we will respond to your firm as processor.