Security and data protection
How client data is protected, and what has not been tested yet
The people whose details are held in Survivor Engine are recently bereaved. Their information includes a whole household's finances and sometimes their health. This page sets out, plainly, how it is looked after.
Where things stand
Survivor Engine is in private pilot and is not yet open for real client data. The measures on this page are in place on the staging service, which holds invented sample cases only. The service will not hold real client data until they are in place on the live service and the data protection impact assessment has been signed.
- No independent penetration test has been carried out. Security testing so far has been internal only.
- The service is not certified to ISO 27001, and it holds no other security certification.
- The rule packs have not yet been adopted by a tax professional, so every report is stamped as a draft.
- The data protection impact assessment is a draft and has not been signed.
We will update this page when any of that changes, and not before.
In place on the staging service
The measures, one by one
-
01
Two-step sign-in
Every user signs in with a password and then a code from an authenticator app. Each code works once. Passwords must be at least 12 characters and are stored only as salted hashes, so the operator cannot read them. An account locks for a time after repeated wrong passwords or codes, and sessions end after eight hours.
-
02
Each firm's data kept separate
Every case belongs to one firm, and one firm cannot see another firm's clients. This is checked on every page and action. Within a firm, users have roles, and only an adviser can sign off a case.
-
03
Retention, erasure and export
Closing a case starts a retention period: six years, or longer for pension-transfer advice, as the advising firm confirms. When it ends, the content is erased. A firm can export a client's case data, and can have it erased on request. Erasure removes the content and keeps only fingerprints, dates and the fact of any sign-off.
-
04
Health data only with recorded consent
Health and smoking information is stored only when the survivor's consent has been recorded. Each time consent is given or withdrawn, the audit trail records it. Without it, the projection uses standard life expectancy.
-
05
Identifying numbers refused or masked
National Insurance numbers, bank account numbers and card numbers are not needed. They are refused when typed into a case and masked when they appear in an uploaded document.
-
06
Daily encrypted backups
The database is backed up every day to a second server. The backups are encrypted, so that a lost or stolen backup cannot be read. Every week a backup is restored automatically to test that it works.
-
07
Tamper-evident audit trail
Every sign-in, case change, calculation, upload, sign-off and rule change is recorded. Each entry is linked to the one before it, so if a record were altered or removed afterwards, a check would show it.
-
08
Uploaded files read, then discarded
When a statement, document or photo is uploaded, the engine reads it and keeps only the file name, a fingerprint of the file and the findings. The file itself is not kept. Text recognition runs on our own server and nothing is sent to an outside service to be read.
-
09
No AI services, no third-party analytics
Client data is not sent to any AI service. The application loads no third-party analytics, fonts or scripts. Its only routine outbound connections are to official publishers, to re-read published figures, and those requests contain no personal data.
-
10
Hosting in the European Union
The service is hosted in data centres in the European Union. Connections are encrypted in transit. The hosting and network providers are named in the privacy notice.
Testing
An internal security test, and its limits
In November 2026 we tested the application ourselves, with access to the source code. The test ran 46 checks covering sign-in, the second step, sessions, access between firms and roles, injection, uploads, data rights and availability.
It found 10 weaknesses. All 10 were fixed, and all 46 checks now pass. The test can be repeated.
This was not an independent penetration test. It was carried out by the people who wrote the code, and self-testing has blind spots. A test by an independent firm is still required before the service holds real client data.
Before real client data
What still has to be done
- An independent penetration test of the live service.
- Adoption of the rule packs by a tax professional.
- Encryption of the database disk itself, and an offline copy of the backup key. The backups are already encrypted.
- A second layer of separation between firms inside the database, before a second firm joins.
- A signed processing agreement with each firm, and a breach procedure with a named person responsible.
- A signed data protection impact assessment.
Minimisation
Collecting less in the first place
- The engine needs dates of birth, not identity documents.
- National Insurance numbers, account numbers, sort codes and card numbers are not needed, and the service refuses or masks them.
- Health information is optional and needs recorded consent.
- Only the survivor's own and joint accounts could ever be connected to a bank feed. Nobody can give consent for a sole account of someone who has died.
Access
Who can see client data
- The signed-in users of the advising firm.
- The operator's administrators, who have technical access to the server in order to run it.
- Nobody else. Client data is not sold and is not used for marketing.
Our network provider handles the encrypted connection to the service and so could technically see traffic as it passes. It is listed as a sub-processor for that reason.
Accuracy
Protection against a wrong figure
For a bereaved person, a wrong number can do as much harm as a data leak. The safeguards are part of the same system.
- Legal figures are checked against their official sources, and a changed figure is set aside until a person has reviewed it.
- Reports are stamped as drafts until a tax professional has adopted the rule pack. That has not yet happened.
- Nothing is advice until the client's own authorised adviser has reviewed and signed it.
- Figures read from scans and photos are suggestions to be confirmed, and are never written into a case automatically.
Survivor Engine does not make decisions about anyone. It produces information for an adviser to review and for the client to decide on.
Disclosure
Reporting a security concern
If you believe you have found a weakness in Survivor Engine, please tell us at george.amoako-atta@quantumsyndicate.ai. We will reply, and we will not take action against anyone who reports a problem in good faith.
Firms considering a pilot can ask for the draft data protection impact assessment, the internal security test report and a description of how data moves through the service.