How Dutira uses personal data.

Dutira plays two different roles under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and it matters which one applies to you.

Dutira as controller

For this website, business enquiries, the free FCA AI Governance Checker, the demonstration workspace, our own customer and supplier relationships, and the security of the platform itself, {{entity}} decides why and how personal data is processed. This notice is written for those activities.

Dutira as processor

When a customer firm deploys the Dutira AI Workspace for its employees, the customer is the controller of the data its people put into the workspace and of the governance records about them. Dutira processes that data only on the customer’s documented instructions under a Data Processing Agreement. Section 4 explains what that means for you as a workspace user.

Where Dutira acts as a processor, questions about why your employer uses Dutira, what it monitors and how long it keeps records should go to your employer. We help customers answer those questions, and we will pass on any request we receive directly.

Company

[Dutira legal entity name — to confirm], registered in England and Wales under company number [company number — to confirm].

Registered office

[registered office address — to confirm]

ICO registration

[ICO registration number — to confirm]

Privacy contact

[privacy contact email — to confirm]

Data protection lead

[data protection officer or lead — to confirm]

Dutira is not authorised or regulated by the Financial Conduct Authority. It provides software to firms that are.

Visiting the site

This website is served by our hosting provider, Netlify, Inc. (San Francisco, USA). Like any web host, it processes the technical information your browser sends — your IP address, the pages requested, browser type and timing — in server and security logs under its own terms. We do not run analytics, advertising or any third-party script on this site; the browser is instructed (through a Content Security Policy) to load nothing from other domains. See the Cookie Notice for the one cookie the product sets and the browser storage the website uses.

Enquiries and demo requests

If you book a demo, request a security review, ask for an assessment follow-up, or register for the checker, we collect what you type into the form: your name, work email address, company, job title, company size, the type of request and any message. We also record the date and time you submitted the form and that you confirmed you had read this notice. We check whether the email domain is a consumer webmail domain so that enterprise enquiries can be prioritised; that flag is stored with the enquiry.

To limit abuse, a one-way hash of your IP address is used to rate-limit submissions for an hour. The IP address itself is not stored with your enquiry.

Enquiries are stored in our hosting provider’s storage and read by Dutira staff. [enquiry forwarding destination — to confirm]: if we forward enquiries to a customer relationship system, that system will be listed in the subprocessor schedule and here.

Marketing

We use enquiry details to respond to your request and for reasonable follow-up about it. We do not send marketing emails today. If we start, business contacts will receive them on the basis of our legitimate interest in promoting a B2B product, with a clear opt-out in every message, and we will update this notice first.

If your employer has deployed Dutira, you reach it through your employer’s single sign-on (OpenID Connect). Your employer provisions your account and decides your role, department and line manager. Your employer is the controller; Dutira is its processor.

In the workspace you can use approved AI models, read your firm’s AI policies, complete training, make attestations, propose AI use cases and report incidents. Depending on your role you may also use governance functions: approving requests, investigating incidents, managing the AI use case register, registering AI agents, or reviewing monitoring data.

The rest of this notice describes what the product records so that you — and your employer’s data protection team — can see exactly what exists. The purposes, lawful bases and retention for workspace data are set by your employer within the options the product offers; section 9 and section 16 describe those options.

We do not ask for, and have no interest in, personal data about anyone under 18. The website and the product are for use at work.

Everything an employee sends to a model passes through the Dutira governance gateway first. The gateway applies the firm’s rules: it can allow a request, warn, mask detected items, hold the request for an approver, or block it. Only requests that pass are sent to the approved model provider, from Dutira’s servers using server-side credentials.

• Blocked requests are not sent to any provider. The product keeps a redacted copy (or none, depending on the firm’s setting) so that the decision can be reviewed.
• Masked items — for example a card number or National Insurance number detected in a prompt — are replaced before the prompt leaves Dutira. Decision records keep only a masked preview (first and last character), not the detected value.
• Uploaded documents in the workspace are limited to 4 MB, checked for type, and reduced to extracted text; the original file is not retained. The extracted text is encrypted at rest.
• Conversations (prompts and responses) are encrypted at rest with a key derived for each customer and deleted by a daily job at the end of the retention period the customer sets (default 90 days). A conversation under an open compliance case is kept until the case closes.
• Model output is checked as it streams back and can be withheld before you see it.

The free FCA AI Governance Checker is different: it runs entirely in your browser. Documents you paste or upload there are read by your browser and are never sent to Dutira or to any model provider. See the checker section of the Terms of Use and the notice on the checker page.

Dutira exists to let firms show how AI is used within their rules. That means the product keeps records about employee activity. Your employer decides to deploy it; the ICO’s guidance on employment practices and data protection: monitoring workers (3 October 2023) sets out what employers must consider first, including a data protection impact assessment for monitoring that is likely to be high risk.

The product is designed to keep that monitoring proportionate:

• Monitoring dashboards show metadata only — rules triggered, models, departments and outcomes — never prompt or response text.
• People in monitoring views are pseudonymised by default (a salted hash). Revealing who is behind a pseudonym requires a specific permission and a recorded reason, and every reveal is written to the audit log.
• Reading the content of another person’s conversation requires a separate permission and a recorded reason, and is audited.
• Line managers see only whether their direct reports have completed training and attestations — not content, explanations or incident detail.
• Confidential and speak-up incident reports hide the reporter’s identity from line managers and from the subject of the report; anonymous reporters appear under a pseudonym even in the audit log.
• The audit log is append-only and hash-chained. It records actions (who approved what, who viewed which incident) so that the firm can evidence oversight; it cannot be edited or deleted through the product, and the database rejects changes to it.

Dutira staff do not routinely access customer workspace data. Access for support or security purposes is limited, logged and governed by the Data Processing Agreement.

Firms can register AI agents — software that takes actions in other systems — with the permissions, financial limits and approval thresholds each is allowed. Every action an agent attempts is evaluated against those controls and recorded: the tool, the connected system, the amount if money is involved, the decision (allowed, held for a person, or blocked) and the reasons.

These records name people: the agent’s business owner, technical owner and accountable senior manager, and anyone who approves a held action. They exist so that the firm can demonstrate human oversight of automated activity. In this release, agent actions are submitted from the governance console to test the controls; a connected agent platform would submit them in the same way.

Where Dutira is the controller, we rely on the following bases under Article 6 UK GDPR:

Where Dutira is the processor, your employer chooses the lawful basis. For workspace records, employers typically rely on their legitimate interests in governing AI use, on legal obligations under the FCA Handbook (for example record-keeping under SYSC 9) and on their employment relationship with you. Consent is rarely appropriate for workplace monitoring, and Dutira’s product does not ask employees for it.

The Data (Use and Access) Act 2025 added a list of “recognised legitimate interests” to UK GDPR and changed the rules on automated decision-making from 5 February 2026. We have taken those changes into account; where a recognised legitimate interest applies (for example responding to an emergency or preventing crime) we may rely on it without a balancing test.

We do not ask for special category data (health, ethnicity, religion, trade union membership, sexual orientation, genetic or biometric data, political opinions) or criminal offence data on this website, and we do not want it in enquiries.

In a customer workspace, such data could appear in three places: in prompts, where the firm’s rules can detect and block or mask it; in uploaded documents, which are reduced to text and encrypted; and in incident reports, where a reporter may describe events affecting health or wellbeing. The customer, as controller, is responsible for identifying an Article 9 condition (usually from Schedule 1 to the Data Protection Act 2018, with an appropriate policy document) before using the workspace for such data. Dutira’s encryption, access controls and audit trail support that, but do not replace it.

The gateway makes automated decisions about requests — whether a prompt may go to a model, whether it is masked, held or blocked. These decisions affect how you use a work tool; they do not produce legal effects or similarly significant effects on you, and held requests are decided by a person. They are therefore not “significant decisions” within Articles 22A–22D UK GDPR (as inserted by the Data (Use and Access) Act 2025). Firms can see every decision and the rule behind it.

The free FCA AI Governance Checker produces an automated, rule-based assessment for information only. It makes no decision about any person.

Dutira itself does not use automated decision-making or profiling that produces legal or similarly significant effects about website visitors, business contacts or workspace users. If a customer configures the product in a way that could (for example an AI agent that affects customers of the firm), the customer is responsible for the safeguards Articles 22A–22D require, and the product’s human-approval and audit features are designed to support them.

Dutira uses a small number of suppliers to run the service. They act as our subprocessors when we process customer data, and as processors of the data we control.

What model providers do with prompts is governed by their published API terms and by the commercial terms a customer or Dutira holds with them. We do not claim that prompts are never retained. As published on 25 October 2026: OpenAI keeps abuse-monitoring logs for API traffic for up to 30 days unless an organisation has been approved for zero data retention; Anthropic offers zero-data-retention arrangements on approval and states that retained API data is not used to train its models without permission; Google states that paid-tier Gemini API prompts and responses are not used to improve its products and are logged for a limited period for abuse detection. [model provider contractual terms — to confirm]: the exact position for each deployment is confirmed and recorded in the DPA subprocessor schedule before go-live.

Customers may also bring their own provider agreements and endpoints (for example a UK or EU regional endpoint); the gateway supports provider base-URL overrides for that purpose.

Dutira is based in the United Kingdom. The suppliers in section 12 are established in the United States, so personal data processed in the demonstration environment, enquiries, and model requests from any deployment that uses a US endpoint are transferred outside the UK.

We rely on the following safeguards, as permitted by Chapter V UK GDPR:

• the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”, in force since 12 October 2023) where the supplier is certified under it and the certification covers the service we use; or
• the ICO’s International Data Transfer Agreement, or the ICO Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment; or
• an adequacy regulation for the destination country (for example EU and EEA member states).

[subprocessor list review — to confirm]: the mechanism relied on for each supplier is recorded in the DPA subprocessor schedule. Transfers from the EU to the UK are covered by the European Commission’s adequacy decision for the UK, renewed on 19 December 2025 until 27 December 2031.

Demonstration environment (this website, enquiries, the sandbox workspace): Netlify, Inc. (San Francisco, USA) — serverless functions in the Ohio (US) region and Netlify Blobs storage in us-east-2 (US).

Customer (production) deployments: the hosting region and database location are agreed for each deployment and recorded in the order form and the DPA. [production hosting region — to confirm]. Customers who require UK-only processing should raise it before contracting, including for model providers, whose regional options are governed by their own terms.

Data residency is not yet a self-service setting in the product. The Security & Trust page shows what is in place today and what is planned.

The measures below are in place today. The Security & Trust page separates them from what is planned, and the DPA lists them as the technical and organisational measures we commit to.

• Encryption in transit (HTTPS with HSTS) and at rest (AES-256-GCM with a key derived per customer, bound to each record), on top of the hosting platform’s storage encryption.
• Tenant isolation enforced in the application and, for PostgreSQL deployments, by forced row-level security and a least-privilege database role.
• Role-based access control checked on the server for every request, with separation of duties on approvals and recorded reasons for content access.
• Single sign-on through the customer’s identity provider (OpenID Connect with PKCE); short-lived, HttpOnly, Secure session cookies; same-origin checks on every state-changing request.
• An append-only, hash-chained audit log with database-enforced immutability and tamper detection on governance records.
• Data minimisation in the gateway: blocked prompts are not sent and are kept only redacted; masked previews instead of detected values; original uploads not retained.
• Model-provider credentials held only on the server; a build check that fails if secret patterns reach the browser bundle.
• A strict Content Security Policy, no third-party scripts, and input validation on every API body.

Dutira does not yet hold ISO 27001 or SOC 2 certification and has not yet completed an independent penetration test. We say so on the Security & Trust page rather than imply otherwise.

At the end of a customer contract we return or delete customer data as the DPA sets out. Because the audit log is designed not to be edited, deletion of a tenant removes the tenant’s records and keys together rather than editing individual entries.

Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing, including processing based on legitimate interests; receive data you provided in a portable format where processing is automated and based on contract or consent; and not be subject to a solely automated decision with legal or similarly significant effects, except where the law allows.

To exercise a right in relation to data Dutira controls, email [privacy contact email — to confirm]. We respond within one month, extendable by two months for complex requests, and we may ask you to verify your identity. There is no fee unless a request is manifestly unfounded or excessive.

If you are a workspace user, send requests to your employer, which controls the data. Dutira helps customers respond — including by exporting the records held about a person — under the DPA. If you contact us directly we will tell you which customer to approach and, with your permission, pass the request on.

You can withdraw consent at any time where we rely on it. You can object to marketing at any time, and we will stop.

This website uses no analytics, advertising or tracking cookies, and loads no third-party scripts. The product sets one strictly necessary session cookie when you sign in, and one short-lived cookie during single sign-on. The website also uses browser local storage so that the FCA AI Governance Checker can remember that you have run today’s free assessment and so the workspace can remember your chosen model. The Cookie Notice lists each item and lets you clear what is stored.

Because nothing beyond strictly necessary storage is used, no consent banner is shown. If we introduce analytics, we will ask for consent first and make refusing as easy as accepting, as regulation 6 of the Privacy and Electronic Communications Regulations 2003 and the ICO’s guidance on storage and access technologies require.

We monitor the platform for security events and have an internal procedure for assessing and containing incidents. Where a personal data breach is likely to result in a risk to people, we notify the Information Commissioner’s Office without undue delay and within 72 hours of becoming aware, and we tell affected individuals without undue delay where the risk is high, as Articles 33 and 34 UK GDPR require.

Where we are a processor, we notify the affected customer without undue delay after confirming a breach affecting its data — [personal data breach notification period — to confirm] — with the information the customer needs for its own assessment and notifications. The customer, as controller, decides on notifications to the ICO, the FCA (for example under SUP 15.3 and the operational incident reporting rules that apply to it) and the individuals concerned.

Security concerns and vulnerability reports can be sent to [security contact email — to confirm].

Questions about this notice or how we handle personal data: [privacy contact email — to confirm], or write to [Dutira legal entity name — to confirm] at [registered office address — to confirm]. From 19 June 2026 controllers must have a procedure for handling data protection complaints; ours is to acknowledge a complaint within 30 days, investigate it and reply with our conclusion and the steps taken.

If you are not satisfied, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to resolve your concern first.

We will update this notice when our practices, suppliers or the law change. The version and effective date appear at the top of the page; material changes affecting customers will also be notified under the DPA.