Stratiform AI went far beyond a standard legal review — the strategic breakdown of risks and opportunities was exceptional They gave us total clarity on our compliance responsibilities — we now know exactly how to manage our obligations The human oversight and editing by a senior professional made all the difference to the quality of the output We can now deploy our team with full confidence that they are protected and well-informed They translated a complex contract analysis into practical, actionable tools our business can actually use Stratiform AI went far beyond a standard legal review — the strategic breakdown of risks and opportunities was exceptional They gave us total clarity on our compliance responsibilities — we now know exactly how to manage our obligations The human oversight and editing by a senior professional made all the difference to the quality of the output We can now deploy our team with full confidence that they are protected and well-informed They translated a complex contract analysis into practical, actionable tools our business can actually use
Security & Data Handling

Trust sits at the
centre of what we do.

Our clients share internal, commercially sensitive — and sometimes highly confidential — information with us. From the outset, our service has been designed to protect that information while still delivering fast, reliable outputs.

🔒
GDPR Aligned
🛡️
Encrypted in transit & at rest
🚫
Never used for AI training
👁️
Human reviewed outputs
🗑️
30-day data deletion
🔐
Multi-factor authentication
☁️
Microsoft 365 Business
🏢
Enterprise-grade infrastructure
🏢

Powered by Microsoft 365 Business — enterprise security as standard

Stratiform AI operates on Microsoft 365 Business with Copilot — the same enterprise-grade platform used by thousands of regulated UK businesses. This means your data is processed and stored within Microsoft's independently certified infrastructure, not on consumer-grade or shared platforms. For sensitive and confidential client work, this provides a level of security assurance that most AI services cannot match.

Microsoft 365 Business
SharePoint — secure document handling
Microsoft Copilot — enterprise AI
ISO 27001 certified infrastructure
SOC 2 Type II certified
No training data use under enterprise agreement
UK data residency available
Why this matters — read this first

Most AI platforms say your data won't be used for training.
That's not the same as your data being private.

When you use a standard AI platform — even one that promises not to train on your data — your information still passes through and exists within their online environment during the session. It is processed on their infrastructure, visible to their systems, and subject to their internal access policies. Not used for training does not mean not retained, not visible, or not at risk.

Before choosing any AI service for sensitive business information, you should ask: where exactly does my data go, who can see it during processing, and what controls exist over that environment? Most platforms cannot give you a clear answer. Stratiform AI can — because we operate within Microsoft 365 Business, a certified enterprise environment with independently verified security controls.

Standard consumer AI platforms
Your data enters their shared online environment
Processed on their infrastructure — you have no visibility
"Not used for training" does not mean not retained
Session data may persist within their systems
Access controls are theirs to define, not yours
No independent security certification for your data
Stratiform AI
Operates within Microsoft 365 Business — certified enterprise environment
SharePoint used for secure document storage and handling
Microsoft Copilot enterprise — no training data use under enterprise agreement
Microsoft infrastructure certified to ISO 27001 and SOC 2 Type II
Only you and authorised Stratiform AI personnel have access
Independent certification verifiable — not just a promise

Stratiform AI uses Microsoft 365 Business with Copilot for AI-assisted processing of client work. This means your documents are handled within Microsoft's enterprise environment — the same infrastructure that financial services firms, healthcare organisations, and legal practices rely on daily. For sensitive or confidential work, this provides a level of assurance that consumer AI tools simply cannot offer.

We recommend that any business sharing sensitive information with an AI service asks these three questions: How is my data processed — through a public platform or a private enterprise environment? Who can see my data during and after processing? What independent certifications cover the infrastructure? Stratiform AI can answer all three clearly and in writing before any work begins.

Our secure working approach

A controlled, deliberate process

Every engagement follows a structured workflow designed to minimise risk and maintain accountability at every stage.

1

You contact us with an enquiry

We clarify scope, expectations, and timescales before anything begins.

2

You receive a dedicated secure upload route

A private, isolated channel created specifically for your engagement within our Microsoft 365 environment — not shared with anyone else.

3

Processing inside Microsoft 365 Business

All AI-assisted processing happens within our Microsoft 365 Business environment using Microsoft Copilot at enterprise level. No consumer AI tools, no shared platforms — your data stays within a certified enterprise infrastructure throughout.

4

Human review before delivery

Every output is checked by a specialist. Accuracy, tone, logic, and quality — all verified before it reaches you.

5

Secure delivery via SharePoint or encrypted link

Documents delivered via SharePoint secure sharing or encrypted download links. Never unsecured email attachments unless explicitly requested.

6

Deletion in line with agreed retention rules

Files deleted after 30 days as standard. Early deletion available on request — permanent and not recoverable.


Technical security

Enterprise-grade. Built in from day one.

🏢

Microsoft 365 Business

Enterprise-grade platform — same as regulated industries
SharePoint for secure document storage and sharing
Microsoft Copilot — enterprise AI with data protection
ISO 27001 certified Microsoft infrastructure
SOC 2 Type II certified
No AI training data use under enterprise agreement
🔐

File storage & access

Encryption in transit and at rest
Strict access controls — authorised personnel only
Activity logging and audit trails
Enforced multi-factor authentication
Continuous platform security monitoring
🤖

AI environment

Microsoft Copilot at enterprise level as primary AI tool
Client data never used to train AI models
No data retained by AI outside the active session
Processing within certified Microsoft infrastructure
No content enters consumer or shared AI environments
👤

Human oversight

Every output reviewed by a specialist
Accuracy and completeness checked
Tone verified for intended audience
Generic AI language removed
Alignment with your original intent confirmed

Responsible use of AI

AI enhances. Humans decide.

AI handles

  • Structuring and formatting documents
  • Drafting from raw inputs
  • Consistent, rapid processing
  • Identifying key information
supervised by

Humans handle

  • All quality control and review
  • Contextual judgement calls
  • Final accountability for outputs
  • Client relationship and communication

AI is used strictly as a support tool — never as an unsupervised or autonomous decision-maker. Our primary AI tool is Microsoft Copilot, accessed at enterprise level within our Microsoft 365 Business environment. As usage and turnover grow, we will expand to additional enterprise AI platforms as appropriate, maintaining the same security and oversight standards throughout.


Data retention

Minimised by design

30
Day standard retention
Retained only as long as needed to deliver the agreed service.
0
Days after early deletion
Requested at any time. Permanent and not recoverable.

Clients remain the Data Controller at all times. Stratiform AI acts solely as a Data Processor.

Payments & invoicing

Simple & transparent

📝

Scope, deliverables, and cost agreed in writing before work begins.

📄

Invoice issued in advance of work starting.

💳

Payment follows agreed terms.

Work begins once payment is received (unless otherwise agreed).

📅

Staged or milestone-based invoicing available for larger engagements.


Further assurance

Regulated sectors & additional documentation

For organisations requiring additional assurance — including regulated sectors, charities, or public-sector-adjacent work — further documentation is available on request before any work begins:

Data Processing Agreements (DPA)
Engagement terms
Detailed security controls documentation
Microsoft 365 compliance documentation
ISO 27001 certification details
SOC 2 Type II certification details

Questions about security?

Get in touch before committing to anything. We're happy to provide full documentation for regulated sectors.