SeedPath processes customer data inside stateful AI systems. That requires more than encryption and a privacy notice: isolation, controlled retrieval, constrained models, inspectable decisions and defined human intervention.
SeedPath acts as a Data Processor for customer deployments. The client remains the Data Controller: it determines the lawful basis, defines the purpose of processing and instructs SeedPath through the service agreement.
SeedPath processes data to provide conversational engagement, appointment workflows, routing and service analysis on behalf of the client.
Clients establish and document their lawful basis, provide the relevant privacy information and ensure the deployment fits their own regulatory obligations.
Retrieval is a controlled orchestration step, not a decision delegated to the language model. The current thread and customer scope determine what data can enter an inference request.
Name, mobile number and email where required by the customer workflow.
Property or mortgage enquiry information required to continue the conversation.
Message history associated with the customer-scoped thread only.
Booking confirmations, workflow status and defined follow-up actions.
SeedPath is not designed to collect these categories. If special-category information is inadvertently submitted, it is handled under the applicable incident and data-handling procedure rather than used by the agent.
SeedPath is cloud-native and does not operate physical servers or data centres. Application controls sit on managed infrastructure, with each layer responsible for a defined part of the security boundary.
HTTPS-only endpoints, HMAC-SHA256 webhook verification, rate limiting, idempotency and injection filtering.
Customer-scoped services, input validation, output sanitisation and recorded execution events.
Managed PostgreSQL and pgvector, tenant identifiers and database row-level security (RLS) for customer isolation.
Encrypted environment secrets, scoped integration credentials and no secrets committed to source control.
Daily backups, point-in-time recovery and a secondary encrypted backup on separate managed cloud storage.
{
"transport": {
"minimum": "TLS 1.2",
"preferred": "TLS 1.3",
"unencrypted_http": "rejected"
},
"storage": {
"encryption_at_rest": "AES-256",
"primary_backup": "daily + PITR",
"secondary_backup": "encrypted / immutable"
},
"recovery_targets": {
"RTO": "4 hours",
"RPO": "1 hour"
}
}Major cloud and SaaS providers maintain their own ISO 27001 and/or SOC 2 assurance. These certifications apply to the provider’s service boundary; they are not presented as SeedPath certifications.
Production access uses individual accounts with multi-factor authentication. Integrations receive the minimum permissions required, while tenant isolation is applied at both the application and database layers.
Generic production credentials are not permitted. MFA is mandatory across production data, source code, database and messaging systems.
API keys and service credentials are issued per integration, can be revoked and are rotated following personnel changes or suspected compromise.
Customer and tenant identifiers constrain database operations so one client’s queries cannot return another client’s records.
Business configuration is stored per customer. Public configuration controls cannot alter SeedPath system prompts or protected operating rules.
Third parties do not receive VPN or direct network access. Integrations operate through authenticated HTTPS endpoints.
Access is reviewed when roles change and removed as part of the documented personnel lifecycle.
Context selection, customer scope and protected instructions are handled by the orchestration layer. The model receives a bounded input and produces a structured output that must pass defined checks.
Inbound content is treated as untrusted user data and is never interpolated into the system prompt. System instructions are injected server-side from a controlled configuration store.
Primary conversation generation runs on SeedPath’s fine-tuned production model. Third-party models may be used for limited classification and fallback functions under contractual data-processing terms.
SeedPath supports the Controller’s obligations across access, correction, erasure and retention. The exact retention rule depends on the service, contractual instructions and any applicable record-keeping requirement.
Data enters through customer-approved integrations and channels for a documented workflow.
The active agent receives the current message, relevant context and current-thread history.
Processing remains within the service scope agreed with the Data Controller.
Retention is documented by product and contract rather than applied as one universal duration.
Verified requests are actioned on instruction from the Controller, subject to applicable legal requirements.
API customers can delete a thread directly. Active message content and conversational state are removed immediately, with limited de-identified operational metadata retained for service reporting.
Managed-service retention may be configured around client instructions and relevant financial-services record-keeping obligations. The applicable period is documented in the customer agreement and data-processing terms.
SeedPath uses managed providers for infrastructure, messaging, observability and limited AI functions. Data-processing terms and appropriate transfer safeguards are applied according to provider location and processing role.
The primary managed database, AI observability environment and SeedPath's production LLM are hosted in the UK/EU adequacy zone. Some providers are headquartered or process data in the United States.
Where an international transfer occurs, SeedPath uses the applicable UK transfer mechanism, including the UK–US Data Bridge where available or contractual safeguards such as the UK IDTA or UK Addendum, supported by transfer-risk assessment where required.
Sub-processor terms, locations and certifications are reviewed periodically and during material architecture changes.
| Function | Typical data | Region |
|---|---|---|
| Managed database | Lead, thread and event data | EU |
| Secondary backup | Encrypted database backup | EU |
| SMS delivery | Message and routing data | UK / US provider |
| CRM and configuration | Business configuration | EU |
| AI fallback/classification | Minimised inference context | Provider-dependent |
| AI observability | Agent execution records | EU |
| Ingress gateway | Webhook and event data | EU / US |
The current named sub-processor list and applicable transfer mechanism are supplied during due diligence and maintained contractually. Regions may vary by service configuration.
SeedPath maintains documented incident-response and business-continuity procedures. Plans are tested through scheduled exercises and reviewed following material incidents.
Initial notification is designed to give affected Controllers time to assess their own obligations. It includes the nature of the incident, affected data categories, likely consequences and containment measures known at the time.
SeedPath provides updates as the investigation progresses and supports customers with required regulatory reporting.
SeedPath distinguishes between controls operating today, assurance inherited from managed providers and certifications that remain on the roadmap.
We use major managed providers with independent security assurance, but do not represent their certifications as our own.
Security, procurement and compliance teams can request the current due-diligence pack, data-processing terms, sub-processor schedule and supporting policy material.