Security and data protection
Specifications carry contractual weight. This page sets out how Avoice protects practice data, how AI handles it, and how practices control who sees what.
01
Certified, tested by a third party, and hosted in the UK. These are the controls a practice's IT lead asks about first.
Avoice Lab holds Cyber Essentials Plus, the UK Government-backed scheme, with the whole organisation in scope. Every device our team uses was audited by an IASME-licensed certification body, not self-declared. The certificate is available on request.
The Avoice application was penetration tested by Casco in February 2026, with remediation independently verified in March 2026. Every finding was fixed; none were risk-accepted. A summary report is available under NDA.
Project data is stored in Amazon Web Services' UK region. UK residency is standard on every plan, including pilots, not an enterprise add-on.
Data is encrypted in transit and at rest. Connections to Avoice use TLS, and stored files, specifications, and registers are encrypted on disk.
Project data is backed up continuously to UK storage. Enterprise agreements include a 99.5% uptime commitment with service credits.
Production access is limited to named engineers, protected by single sign-on and multi-factor authentication, and revoked within two hours of anyone leaving. Our Google Workspace integration has passed Google's CASA security assessment.
02
Practices rightly ask where their specifications go when AI drafts them. The answer is short.
The AI model providers Avoice uses operate under zero-data-retention terms. Prompts and outputs are not stored by them once a request completes.
Third-party model providers do not train on your specifications, drawings, or correspondence. Your practice's clause library and masters stay private to your practice.
Avoice carries professional indemnity, cyber, and AI liability cover. The insurance certificate is part of our standard terms pack.
