Capital Planning & Project Delivery

The assurance a buying committee needs, in one place.

Security, privacy, resilience and governance: what's in place, what's in progress, and what we'll confirm on request.

Security and compliance document review

Security, privacy, resilience and governance.

Organised into four domains – the same groups used on the Platform page. Here's where we're certified today, and the standards and practices we operate to in each.

01 · Security

Protecting the platform

Certified to ISO 27001; SOC 2 Type II in progress.

Status

HeldISO/IEC 27001 (ISMS)
In progressSOC 2 Type II – report under NDA

Standards & practices

  • Encryption in transit (TLS 1.2+) and at rest (AES-256), with managed key rotation
  • Enforced multi-factor authentication and a strong credential policy
  • Independent penetration testing and continuous vulnerability scanning
  • Secure SDLC: code review, dependency & secret scanning, least-privilege pipelines
  • Continuous monitoring, logging & alerting

Governed AI – and nothing
trained on your data.

How MIRI uses operational context and the controls around it. The full model approach and maturity path are documented in AI Transparency.

Never trained on your data

The AI reasons over your operational context to assist your teams; your data is not used to train models.

Human-in-the-loop

People stay accountable for consequential decisions – the AI proposes, your teams decide.

Governed & auditable

Every AI action is logged and explainable, and stays within defined boundaries.

Isolated & resident

Your data stays isolated to you, with residency options by region.

Want the full picture? Model approach, decision boundaries, accountability and the assisted → automated → autonomous maturity path are all documented on the dedicated page.

Explore AI Transparency

Security and assurance
documents.

Summaries and standard assurance materials are available directly; sensitive materials are provided on request or under NDA.

  • Security overview

    A plain-English summary of controls, hosting and data handling.

    OpenPDF
    Download
  • Data Processing Addendum (DPA)

    Standard DPA covering roles, sub-processors and safeguards.

    OpenPDF
    Download
  • Business continuity & DR summary

    Resilience posture, backup approach and recovery targets.

    OpenPDF · summary
    Download
  • SOC 2 Type II report

    In progress

    Independent audit report – shared under NDA once available.

    Under NDAAudit report
    Request access
  • Penetration-test summary

    Latest independent test summary letter.

    Under NDASummary letter · on request
    Request access