Your infrastructure if you want it
Self-hosted n8n, containers and the knowledge stores can run in your AWS, Google Cloud or Azure account.
Security
How we handle your data
The brain reads your most sensitive material: conversations, calls and contracts. Here is where it runs, who can see it, which agreements cover it, and what happens when the project ends. Written for UK GDPR, EU GDPR and the EU AI Act.
Where it runsOur cloud set-up or your AWS / GCP / Azure
AgreementWritten DPA on every project
AI providersOpenAI, Anthropic or Google, business terms, no training on your data
End of projectReturn or delete on your instruction, confirmed in writing
01Principles
Five rules on every project
Minimum data
We connect only the channels and folders you choose, and exclude any you name — HR, legal, finance, personal messages.
Access mirrors your access
Nobody gets an answer from a source they could not open themselves. Role-based access is built where needed.
Everything in writing
A DPA names the data, purposes, sub-processors, regions and retention. Changes to any of them are agreed in writing first.
Yours to take back
Return or deletion on your instruction at the end of the project, with written confirmation.
02Legal basis
UK GDPR, EU GDPR and the EU AI Act
Roles
You are the controller of your company’s data; Uprising Agency Ltd acts as processor under a written data processing agreement. Where we use cloud and AI providers, they are sub-processors named in the agreement, and we tell you before adding a new one.
Transfers
Data for UK clients is kept in the UK or the EU; the UK–EU adequacy arrangements cover transfers between the two. Transfers to providers outside the UK and EU use the UK Addendum to the EU standard contractual clauses or an equivalent mechanism.
People’s rights and complaints
Requests from your employees or customers about their data are routed to you as the controller, and we help you answer them within the statutory time. We keep a complaints procedure and respond within 30 days.
AI transparency
Bots built on the brain identify themselves as AI. Where the brain produces a document a person will read as human-written — a proposal, a report — the person who sends it reviews it first.
Security measures
Encryption in transit and at rest, access on a need-to-know basis with two-factor authentication, logged access to knowledge stores, separate environments per client, and backups with a retention period set in the agreement. Incidents affecting your data are reported to you without undue delay so that you can meet your own notification duties.
FAQ
Questions clients ask first
Where is our data stored?
Where you choose: on our cloud set-up or on your own infrastructure in AWS, Google Cloud or Azure. For UK and EU clients we use UK or EU regions unless you ask otherwise. The exact regions and sub-processors for your project are listed in your data processing agreement.
Which AI providers see our data?
The one your company prefers: OpenAI, Anthropic or Google, under their business terms, which exclude training on your data. Where a client requires it, we can run open-weight models on the client’s own infrastructure instead.
Do you sign a data processing agreement?
Yes. Every client project runs under a written data processing agreement that follows UK GDPR and EU GDPR, naming the data, the purposes, the sub-processors and the retention period.
Who on our side can see what?
Access to the brain mirrors the access people already have. For teams with different needs we build role-based access on top, so a department sees only its own sources.
What happens to our data when the project ends?
We return or delete it on your instruction, and confirm the deletion in writing. Backups are purged on the schedule set out in the agreement.
Does the brain tell people it is an AI?
Yes. Bots identify themselves as AI in their profile and first message, in line with the EU AI Act transparency rules that apply from August 2026.
Need the paperwork before the demo?
Ask for our data processing agreement and sub-processor list. We send them before any data is connected.