Trust centre
Security, data and delivery
Written for the person who has to sign this off rather than the person who wants it. Everything below is what we actually do. Where the honest answer is “we do not hold that”, it says so, because the first procurement question would expose anything else.
Two services, two different answers
This is the single most important thing on the page. We sell bespoke consultancy and we sell a hosted product, and they handle your data differently. Anyone telling you one answer covers both is not being careful enough.
Your environment
Bespoke consultancy work
We build inside your Microsoft 365 tenant, your SharePoint, your CDE and your existing systems. Your data does not move and we do not hold a copy of it. You own the workflows, the code and the credentials, and you can revoke our access yourself at any time.
Data protection roles: You remain the data controller throughout. We are working on your systems under your instruction rather than processing your data on our own infrastructure.
Our EEA infrastructure
Construction Metric, the hosted product
Project records are held on dedicated infrastructure in the European Economic Area, in Helsinki, with encrypted backups. AI structuring runs transiently in the United States under UK transfer safeguards. Every sub-processor is named in the data processing agreement.
Data protection roles: Your business is the data controller and AI Metric Ltd is the data processor, acting on your documented instructions under a data processing agreement.
Full detail on the product side is on the Construction Metric security and GDPR page, including named sub-processors, retention and deletion.
Access to your systems
- Least privilege, scoped narrowly. Where the work allows it we ask for access to named SharePoint sites rather than the whole tenant. We would rather have a slower first week than standing tenant-wide permissions we do not need.
- Granted and revoked by you. Access is granted through your own administration, is visible to your administrators, and can be withdrawn by you at any point without needing our cooperation.
- Encrypted in transit and at rest, with credentials and keys handled through standard secret management rather than spreadsheets or chat messages.
- Logged. Access events are recorded so there is an answer to who touched what and when.
AI providers, and what happens to your material
Your content is used to do your work and nothing else. It is not used to train models, ours or anybody else’s, and we select providers and configure settings on that basis. Where a specific model provider is used on your project we will name it, and if you need a particular provider excluded for procurement reasons, say so at the start and we will design around it or tell you we cannot.
A human stays responsible
Every output is a draft for a named person to review, with the source material it drew on shown alongside it. Nothing is published, issued or submitted automatically. This is not caution for its own sake: in UK construction the duty sits with a named person and cannot be delegated to a system, so anything that obscured who approved what would be actively harmful to you. We write more about where that line falls in AI can read the contract, it cannot become the dutyholder.
Ownership, handover and exit
You own what we build. Code, workflows, documentation and credentials are yours and are handed over as part of delivery rather than held back as leverage. We build on mainstream, well-supported tools rather than clever fragile ones specifically so that another competent developer can maintain what we leave behind. Automation that only one person understands is a risk, not an asset.
What we do not have
- No ISO 27001 and no Cyber Essentials Plus. We hold no formal information security certification. We are not going to dress that up. If it is a hard requirement in your supply chain, tell us early.
- A short corporate history. AI Metric Ltd was incorporated in May 2025. There is not yet a decade of filed accounts for your procurement team to read, and no amount of website copy changes that.
- Founder-led delivery. We are small. That buys you senior attention on every engagement and it costs you the depth of bench a large integrator has. Both halves of that are true and you should weigh them.
- Insurance and assurance detail on request. Professional indemnity and cyber cover positions, and any supplier questionnaire you need completing, are shared directly rather than published here.
If something goes wrong
If an incident affecting your data occurs we notify you without undue delay, with what we know, what we have done and what happens next, so that you can meet your own obligations under UK GDPR rather than finding out late and second-hand.
Common questions
Does our data leave our environment?
For bespoke consultancy work, no. We build inside your Microsoft 365 tenant, your SharePoint and your systems, so the data stays where it already is and we do not take a copy. For Construction Metric, which is a hosted product rather than a bespoke build, records are held on dedicated infrastructure in the European Economic Area and AI structuring runs transiently in the United States under UK transfer safeguards. Those are two different answers because they are two different services, and you should know which one you are buying.
Is our data used to train AI models?
No. Not ours, not a provider’s. We design pipelines so client and project material is never used as training data, and we choose providers and settings accordingly. This applies to both the consultancy work and the product.
What access do you need to our Microsoft tenant?
The least that will do the job, scoped to named sites rather than the whole tenant wherever the work allows it. Access is granted by you, is visible to your administrators, and can be revoked by you at any time without asking us. We would rather have a slower first week than standing tenant-wide permissions.
Are you ISO 27001 certified?
No, and we are not going to imply otherwise. We are a small, recently incorporated company and we hold no formal information security certification today. What we can give you is a straight description of how we actually work, on this page, plus a willingness to complete your own supplier assurance questionnaire honestly. If a certification is a hard procurement requirement for you, tell us early and we will say whether we can meet it rather than waste your time.
What happens if we stop working with you?
You keep everything. Code, workflows, documentation and credentials are yours and are handed over. We design for handover from day one, because automation only one person understands is a liability rather than an asset. There is no lock-in mechanism, no proprietary runtime you have to keep paying for, and no hostage data.
Do bespoke projects have to use Construction Metric?
No, and we want to be unambiguous about it because we are aware of the conflict. Construction Metric is our product, and a consultancy that also sells a product has an obvious incentive to steer work towards it. Bespoke engagements are tool-neutral. We recommend Construction Metric only where it is genuinely the right answer, we recommend other vendors’ products regularly, and we take no commission from any software vendor.
You are a small company. What happens if the founder is unavailable?
A fair question and the honest answer is that we are founder-led, so continuity is a real consideration rather than one we can wave away. What we do about it: everything we build is documented, held in source control you have access to, and built on mainstream tools with a wide pool of people who can maintain them rather than anything exotic. If we disappeared tomorrow, another competent developer could pick up your system. That is a deliberate design constraint, not a happy accident.
Something here not answered?
Send the question, or send your supplier assurance questionnaire. We would rather answer it honestly up front, including where the answer is no, than discover a blocker after everyone has spent three weeks on it. Email chris@ai-metric.com.