Compliance Summary

Registered with ICO under ZB812547

DPO appointment in progress — required before full commercial launch

ICO Regulatory Sandbox referenced (not SRA — CourtCraft is not a regulated legal firm)

Full UK GDPR-compliant privacy policy published

Data Protection Impact Assessment published and linked from footer

LIA completed for all Article 6(1)(f) processing activities

72-hour ICO notification workflow and internal incident log implemented

Full Article 30 RoPA published — 10 processing activities documented with legal basis, data categories, retention periods, and third-party processors

Full data export (JSON) available via GDPR Compliance Centre in dashboard

Account deletion request workflow implemented with 30-day processing SLA

Machine-readable JSON export of all user data available on demand

Profile data correction available via GDPR Compliance Centre

Article 18 restriction request workflow implemented in GDPR Compliance Centre — users can submit restriction requests with reason; logged to gdpr_requests table; email confirmation sent

Article 21 objection workflow implemented in GDPR Compliance Centre — users can object to legitimate interest processing and direct marketing; grounds selection and reason required; logged and email confirmation sent

Shown to all new users before any special category data is processed

Deterministic (non-AI) gate with 40+ patterns; CRITICAL tier blocks AI and shows non-dismissible crisis modal with NSPCC (0808 800 5000) and Samaritans (116 123)

Anonymised DASH screening events logged for regulatory compliance

All data encrypted at rest (AES-256) and in transit (TLS 1.3) via Supabase

DPA available at supabase.com/dpa — must be executed before full launch

Data Processing Addendum available — must be executed before full launch

Data Processing Addendum available — must be executed before full launch

Stripe Data Processing Agreement available — must be executed

DPA required for transactional email processing

No Article 28 DPA executed. PII-stripping implemented as interim measure — all personal data stripped before Perplexity API calls. DPA required before full launch.

DPA available at calendly.com/legal/dpa

Clear AI disclaimers on all AI-generated content; mandatory human review before court submission

No Article 22 automated decisions with legal effect — all AI output requires human review

Platform correctly identifies ICO (not AISI) as the relevant regulator

voyage-3.5 configured as active embedding model; pgvector storage implemented

AI agent hard-coded to refuse Court of Protection / MCA 2005 matters and display Official Solicitor referral

AI agent detects care proceedings / PLO triggers and displays mandatory legal aid gate before any guidance

Mandatory disclosure added to all AI responses citing case law: results represent reported principles only — the majority of family court decisions are never published

PII-stripping function implemented in legal-research API route — removes names, postcodes, phone numbers, email addresses, case references, NI numbers, and addresses before every Perplexity call

Corrected per McKenzie v McKenzie [1970]; Legal Services Act 2007 boundaries accurate

All SRA sandbox references removed — CourtCraft is not a regulated legal firm

ZB812547 displayed in Privacy Policy, DPIA, consent modal, and GDPR widget

UK-law governed terms with accurate McKenzie Friend and liability provisions

Onboarding Step 1 now displays mandatory warning that consumer AI use constitutes irreversible confidentiality breach that cannot be restored by any subsequent DPA

REQUIRED BEFORE LAUNCH: Voyage AI has no EU/UK region. An International Data Transfer Agreement (IDTA) is required under Article 46 UK GDPR for special category data. Resolution options: (1) Execute IDTA with Voyage AI; (2) Route via Azure UK South deployment; (3) Self-host on AWS eu-west-2. Current direct API call to api.voyageai.com is an Article 46 violation for special category data.

REQUIRED BEFORE LAUNCH: Anthropic API is used directly (not via AWS Bedrock). An IDTA is required with 4 non-standard terms including an automatic trigger clause for UK-US Data Bridge suspension. Anthropic Schedule B.3 special category amendment required. Estimated cost: £2,000–£4,000 legal fees. Alternative: migrate to AWS Bedrock eu-west-2.

ARCHITECTURAL REQUIREMENT: Report mandates Tier 1 (divorce/financial remedy) via AWS Bedrock eu-west-2 only; Tier 2 (child arrangements) with human review gate; Tier 3 (domestic abuse/PD12J/CAFCASS) via Mac Studio M4 Max local processing ONLY — never cloud API. Currently all AI requests route through the same API regardless of data sensitivity. Tier 3 prohibition is architecturally violated for DASH-flagged cases.

IRREVERSIBLE DECISION: Supabase region must be confirmed as eu-west-2 (London) before first production client data. This decision cannot be changed after data is stored. Confirm region in Supabase dashboard and document as Gate Evidence G1. No confirmation on record.

REQUIRED BEFORE PHASE 2 (first production client data): E&O (Errors & Omissions) and Cyber Liability insurance must be bound. Recommended brokers: Insure24, Lockton. This is a hard gate before accepting paying clients with live case data.

REQUIRED BEFORE LAUNCH: A written legal opinion from a qualified solicitor confirming CourtCraft's activities are non-reserved under the Legal Services Act 2007. Estimated cost: £3,500. This opinion is required for investor due diligence and regulatory credibility. Not yet commissioned.

REQUIRED BEFORE RAG CORPUS CONSTRUCTION: A licence from The National Archives (TNA) is required before using the TNA Find Case Law API for RAG corpus construction. BAILII Terms of Service prohibit bulk downloading. No TNA licence has been applied for.

REQUIRED BEFORE LAUNCH: Documented Phase 0 kill-switch test comparing voyage-3.5 vs voyage-law-2 vs Qwen3 8B on 3 UK family court documents with 30 queries. Results must be logged as Gate Evidence G11. No test has been conducted or documented.