Built to be examined by your regulator

This page is maintained by ClientCouncil.ai to answer common security, privacy and governance questions about the platform. It describes controls that are in place or offered as part of a deployment; it is not an independent certification or an audit report.

Full audit trail

Every score, source, model version and human override is written to an append-only log with a content hash and is exportable for examination. A typical trail entry records the actor (model version, named reviewer or committee), the action (re-score, dossier view, override), the affected profile, the evidence bundle attached, and the hash of the entry.

Human in command

The Council recommends; your committee decides. Overrides are first-class objects rather than exceptions: they are recorded with rationale, attributed to a reviewer, and carried into the exported decision pack.

Data residency

Single-tenant deployment in your jurisdiction — Switzerland, the European Union, the United Kingdom, Singapore or the United States. Client data is not used to train shared models.

Access and authentication

Access to the console requires an authenticated account. Application data is segregated per account with row-level authorisation enforced in the database, so a signed-in user can only reach the prospects, verdicts and audit records belonging to their own institution.

Model governance

Model versions are recorded on every verdict. Institutions may supply their own model credentials for OpenAI, Anthropic, Google Gemini and other providers, in which case inference runs against the institution's own account and the provider and model used are logged with each interaction.

Shared responsibility

ClientCouncil.ai is responsible for the platform's controls described above. The institution remains responsible for its own acceptance policy, the lawfulness of the data it submits, the decisions its committee records, and its own regulatory obligations. Certification and compliance commitments for a specific deployment are agreed in the engagement contract — ask for the current control pack when you request a briefing.

Reporting a vulnerability

Email security@clientcouncil.ai with a description and reproduction steps. We acknowledge reports and will not pursue action against good-faith research.