01 Security & deployment
ContextIQ connects to important working information, so security, privacy and control are fundamental to how the product is being built. This page separates what exists today from what is planned.
02 Available today
Everything in this section is in the product now. Roadmap items are kept separate, further down.
ContextIQ runs on infrastructure hosted in the European Union.
Your data is encrypted while moving between systems and while stored.
Sources are connected deliberately, one at a time, and can be disconnected at any point.
You can take your ContextIQ data out whenever you need it.
Your ContextIQ data can be removed on request, including when a workspace is closed.
03 Integrations and permissions
Supported sources are connected through the provider's own authorisation flow. ContextIQ does not ask for your source-system password, and connections can be withdrawn when they are no longer needed.
You approve each connection through the source provider's authorisation flow. ContextIQ receives an access grant rather than your login credentials.
Sources are connected at workspace level, making what enters ContextIQ a deliberate workspace decision rather than a default.
Disconnect a source through ContextIQ or revoke its authorisation through the source provider to stop future access.
04 AI and your data
ContextIQ uses third-party language models to help interpret and contextualise relevant information. The original source material is processed for the task, not retained as a permanent copy inside ContextIQ.
When ContextIQ needs AI processing, it retrieves and selects the information relevant to the task, applies the appropriate redaction and contextualisation steps, and sends only the required selection for model processing. For question answering, ContextIQ retrieves relevant context rather than sending your entire workspace with every query.
ContextIQ does not train models on your company's data. Model-provider configurations are used that are intended to exclude customer content from provider-side model training.
ContextIQ does not keep permanent copies of the original content pulled from your connected sources. It stores the contextualised outputs generated from that information so your team can retrieve useful organisational context later. Those outputs are covered by ContextIQ's export and deletion controls.
ContextIQ itself is hosted in the EU. Third-party model providers operate their own infrastructure, so some model processing may occur outside the EU-hosted ContextIQ environment. Organisations with stricter infrastructure, residency or AI-processing requirements should review the private deployment section below.
If your security review requires the current provider list, processing locations or provider retention terms, we can provide the relevant details. Request the detail
05 Ownership and data protection
ContextIQ is built around UK and European data-protection principles: purpose, control and the ability to leave.
The information you connect remains yours. ContextIQ processes relevant source information to create useful organisational context without retaining permanent copies of the original source material.
Export your ContextIQ data, disconnect your sources and have the workspace and stored contextual outputs removed.
EU hosting, deliberate source connections, data minimisation and deletion controls are deliberate product decisions rather than later additions.
If your procurement or security review requires a DPA or subprocessor information, talk to us and we will work through the requirements with you.
06 Security roadmap
These are roadmap items rather than certifications ContextIQ currently holds. We publish them so customers can understand the direction of the security programme.
ISO/IEC 27001 certification is on the ContextIQ roadmap as we continue formalising our information-security management processes.
Cyber Essentials is being considered as an earlier-stage external validation of core cybersecurity controls.
ContextIQ is reviewing how applicable EU AI Act requirements relate to the product, its AI processes and future governance requirements. The EU AI Act is legislation, not a certification.
AI management-system certification may be considered as ContextIQ matures and customer requirements evolve.
07 Private deployment
For organisations with stricter infrastructure, data-residency or cloud-AI requirements, ContextIQ is technically validating private and sovereign deployment options designed to reduce reliance on shared public-cloud AI infrastructure.
We are working with infrastructure partners to explore and validate these architectures. They are not available as a standard production deployment today. If private deployment is a requirement for your organisation, tell us what your environment demands.
Sensitive matter and client context may require stronger controls and deployment flexibility.
Data residency, model-provider and infrastructure requirements may be stricter.
Client confidentiality can make security and access controls part of the buying decision.
Questionnaires, provider details, residency requirements or deployment constraints. Tell us what your review requires and we'll tell you clearly what we can and can't support today.