Your data stays yours. Here is how we protect it.

Centrus has been Cyber Essentials certified since 12/06/2026. Our core infrastructure providers hold SOC 2 Type 2.

We work with Cambridge Cyber Security towards a formal ISO 27001 assessment in 2027. We are not ISO 27001 certified today. We would rather say what is live than imply certificates we do not yet hold.

Core platform data, including the database, file storage, sign-in and application logs, is hosted in the UK and EU. Where a provider processes data outside the UK or EU, we put appropriate safeguards in place, as set out in our data processing agreement.

The full list of subprocessors is available on request.

Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256. That covers your files, the search index built from them, user accounts and logs. The tokens that connect Microsoft 365 and Google Workspace are encrypted at rest too.

Each organisation’s data is kept separate from every other organisation’s. Inside yours there are two roles, administrator and standard user, and tags decide what each person can ask about. An answer only draws on the tags of the person asking.

Anyone can turn on two-factor authentication, so signing in also needs a code sent by text message.

Administrators choose which SharePoint, OneDrive and Google Drive folders sync, and anything not chosen is never read. A Microsoft or Google connection only sees what the person who connected it can already see. Disconnecting it revokes the access and removes the synced files.

Your data is not used to train AI models, and training is switched off on our AI provider account. That covers your files, your chats and everything Centrus writes for you.

Agents only take the actions you build into them. Where you add an approval step, they wait for a person before anything sensitive happens. Every agent run is logged.

Centrus staff do not routinely access customer content. Support access is limited, logged and only given where there is an authorised need, such as a ticket you raised.

Technical staff are background-checked and everyone completes security awareness training. Administrative access is reviewed every week, and we run a security risk assessment every quarter.

Customer Data is kept for as long as it is needed to provide the Services. After you leave, or ask us to delete it, we delete it within 90 days, unless the law requires us to keep it longer or we have agreed otherwise in writing. You can ask for an export first, in a commonly used format.

Centrus follows UK GDPR. We are the processor for the data you put into Centrus, and the controller for our own business records, as the Privacy Policy explains. The processing terms every customer gets are in clause 6 of the Terms of Service.

If a personal data breach affects your data, we tell you without undue delay, and within 24 hours of becoming aware of it. We give 30 days’ notice before adding a new subprocessor, and you can object.

A signed data processing agreement, with the full list of subprocessors, is available on request. Enterprise customers can ask for one tailored to them. Our Data Protection Officer is Jack Oliver Melluish, at support@centrus.ai.

Report security incidents through the help centre. For anything urgent, also email support@centrus.ai with URGENT in the subject.

Standard incidents get a response within one working day. Urgent incidents get a response the same day, 08:00 to 17:00 UK time, Monday to Friday.