Security, privacy and architecture

ISO/IEC 27001

This product is not ISO 27001 certified. Certification is an organisational audit of people, suppliers and operations — it cannot be claimed from application code. Technical controls here (encryption, headers, minimisation, export and erasure) are the pieces a future certification would inspect.

On-device processing

Route dates, absences, fees and document scans run in this browser. Encrypted vault files never leave the device. Document copies stay in this browser. AWS S3 is not connected. Client-side AES-GCM ciphertext is not uploaded, even if a bucket were configured.

Four services, one app

Rule engine, documents, notifications and analytics are separate libraries with typed events. They are not network microservices. Kafka and AWS SQS are not connected — Events stay in this process. Kafka and AWS SQS are not connected. This planner will not report a broker delivery that did not happen.

• Rule engine

  on-device

  ILR, citizenship, absences and fees run as a pure function in this browser (the same function as /api/calculate). Results are not stored unless you save a plan.

• Document processing

  on-device

  OCR-from-paste, AES-GCM encryption and completeness checks stay on this device. Ciphertext is never uploaded to S3 or /api.

• Notifications

  in-process

  Reminders are .ics, mailto, or browser alerts. GOV.UK Notify is used only when API keys are set (public-sector deployments).

• Analytics

  in-process

  Opt-in anonymous sketches (visa category, coarse nationality region, sketched dates). Groups smaller than 5 are hidden. No name or email.

GDPR

• Access. Open /account while signed in, or download guest data from the same page.
• Data portability. Download JSON (GDPR export schema). Vault files stay on the device and are not in the file.
• Erasure. Delete the account (type DELETE) or clear this browser as a guest. Anonymous benchmarks cannot be matched back to you.
• Minimisation. Do not enter passport numbers, Home Office references, or biometric IDs. The vault redacts detected numbers to the last four characters.

Account export and deletion · Privacy notice

What is processed

• Guest plan

  Sketch a visa → ILR → citizenship path in this browser

  device · Until you clear this browser

• Signed-in account

  Reopen a plan across devices

  server · Until you delete the account

• Document vault

  Optional encrypted copies of evidence

  device · Until you clear the vault or this browser

• Read-only share links

  Let you show a redacted snapshot to an adviser or employer

  server · Until expiry, revoke, or account deletion

• Anonymous benchmarks

  Opt-in averages once a cohort has at least five sketches

  server · Not tied to an account; cannot be erased by email

• Service and adviser enquiries

  Preview introductions (not a live marketplace instruction)

  server · Until account erasure (matched by user id or email)

• Employer worker sketches

  HR expiry buckets and GOV.UK right-to-work links

  server · Until the organisation owner deletes the account

• GOV.UK page polls

  Notice when an official page was updated after encoded review

  server · Page title, description, timestamp — not your plan