LEGAL & COMPLIANCE DOSSIER
Privacy Policy
Effective Date: August 19, 2026
- Details UK GDPR data protection standards for the Sentivox Private AI Workspace.
- Confirms UK-only data residency (London), hardware-isolated clean-room processing, and zero model training.
- Clarifies Sentivox’s role as Data Processor acting strictly on the instructions of the Client.
1. Introduction and Role as Data Processor
Sentivox provides private artificial intelligence workspaces, encrypted document vaults, and custom workflow assistants for data-sensitive businesses and professional practices (our "Clients").
When Sentivox processes documents, records, or work email logins on behalf of a Client, the Client acts as the "Data Controller" and Sentivox acts strictly as a "Data Processor" under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
When Sentivox processes documents, records, or work email logins on behalf of a Client, the Client acts as the "Data Controller" and Sentivox acts strictly as a "Data Processor" under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In Plain English
Sentivox is a B2B provider. Your firm is the Data Controller (you own and control the data), and we act strictly on your instructions as Data Processor.
2. Information Processed Within Your Private Workspace
To operate your private workspace and custom workflow agents, the system processes two categories of information strictly under your control:
a) Vault Documents & Business Records: Files uploaded to your vaults or checked by your workflow agents (such as PDFs, spreadsheets, leases, and statements) are encrypted in your browser before transit, processed inside volatile clean-room memory in London, and stored in your encrypted UK database locked under your firm’s master key. Working memory is wiped clean the moment a task completes.
b) Staff Login & Audit Records: To verify staff access and maintain your firm’s 7-year compliance log, the platform records the work email address, name, and directory group of authorised staff members signing in via Microsoft 365 or Google Workspace.
a) Vault Documents & Business Records: Files uploaded to your vaults or checked by your workflow agents (such as PDFs, spreadsheets, leases, and statements) are encrypted in your browser before transit, processed inside volatile clean-room memory in London, and stored in your encrypted UK database locked under your firm’s master key. Working memory is wiped clean the moment a task completes.
b) Staff Login & Audit Records: To verify staff access and maintain your firm’s 7-year compliance log, the platform records the work email address, name, and directory group of authorised staff members signing in via Microsoft 365 or Google Workspace.
In Plain English
We only process the documents your team puts into your encrypted vaults and the basic work email logins needed to check staff permissions and keep your 7-year compliance log.
3. Strict Prohibition on Model Training & Third-Party Sharing
Sentivox never sells, rents, or shares Client Data or personal information with third-party marketers or external AI providers.
All primary AI reasoning, document reading, and workflow checks run on self-hosted models inside sealed UK hardware enclaves with no outbound connection to the public internet. Your firm’s data is never used to train or fine-tune any AI model.
All primary AI reasoning, document reading, and workflow checks run on self-hosted models inside sealed UK hardware enclaves with no outbound connection to the public internet. Your firm’s data is never used to train or fine-tune any AI model.
In Plain English
We never sell your data, send it to public AI companies, or use it to train AI models. Everything stays inside your sealed UK clean room.
4. UK Data Residency and Sub-Processors
All client workspaces, confidential compute enclaves, databases, and 7-year compliance logs are hosted exclusively in the United Kingdom (London — europe-west2) on Google Cloud Platform infrastructure.
Because data remains inside your encrypted UK boundary under your firm’s master key, no confidential client records are transferred outside the UK.
Because data remains inside your encrypted UK boundary under your firm’s master key, no confidential client records are transferred outside the UK.
In Plain English
Your entire system and all stored files stay strictly in London (UK), avoiding overseas data transfer risks under UK GDPR.
5. Security, Master Key Control & Instant Deletion
All data is protected in transit via TLS 1.3 and end-to-end browser encryption, in use via AMD SEV-SNP hardware memory encryption, and at rest via AES-256-GCM encryption bound to your Customer Master Key.
At any time, the Client can revoke their master key or request full account deletion, rendering all stored records permanently unreadable.
At any time, the Client can revoke their master key or request full account deletion, rendering all stored records permanently unreadable.
In Plain English
Your data is encrypted at every step, and because you hold the master key, you can lock or permanently erase your data at any time.