Mastercopy has looked after businesses across the UK since 1989. This is where we set out, in one place, how we protect the information our customers entrust to us — our certifications, security practices, data-protection position, AI governance and sub-processors.
Our management systems are independently audited and certified. Certificates are available for verification on request.
Mastercopy complies with the UK GDPR and the Data Protection Act 2018, and follows guidance from the Information Commissioner's Office (ICO). We are registered with the ICO under reference ZB864771.
Public policies: Privacy Policy · Cookie Policy · Terms
We use a small number of carefully assessed sub-processors to deliver our services. Each is assessed before use and at least annually against our supplier due-diligence criteria (security posture and certifications, data-handling and training commitments, contractual terms, and data residency). Customers are informed of the sub-processors relevant to their deployment.
| Provider | Purpose | Data handling |
|---|---|---|
| Anthropic (default) | Document AI — classification, extraction, summarisation, Aida assistant | Commercial API; customer inputs/outputs not used to train models |
| OpenAI (optional) | Alternative document-AI provider | Commercial API; not used for model training |
| Groq (optional) | Alternative inference provider | Commercial API; not used for model training |
| On-premises (self-hosted) | Optional fully on-premises AI | Zero external egress — inference runs entirely in the customer environment |
| Provider | Purpose | Assurance |
|---|---|---|
| Established cloud providers | Application hosting, edge/CDN, web application firewall and frontend hosting | Independently certified to ISO/IEC 27001 and/or SOC 2 Type II |
| Microsoft (365 / Entra ID) | Email, productivity and identity / single sign-on | ISO/IEC 27001, SOC 2 |
| Tooling | Purpose |
|---|---|
| Microsoft Defender | Endpoint protection for managed devices |
| Huntress | Managed threat detection and response |
| Acronis | Backup and recovery |
AI is built into DocFlow and the Aida assistant. We operate a documented AI Management System (AISMS) aligned to ISO/IEC 42001, supported by an AI Ethics Policy and a completed Data Protection Impact Assessment.
Our security controls operate under our ISO/IEC 27001-certified Information Security Management System and are layered across our platforms and services.
Mastercopy does not operate its own physical datacentre. Production services are hosted on established cloud providers independently certified to ISO/IEC 27001 and/or SOC 2 Type II, under a shared-responsibility model. DocFlow is UK-hosted, with a fully on-premises option available.
Software is built under a documented Secure Development Lifecycle (SDLC) operating within our ISMS, with security and privacy considered from the design stage.
Security and AI incidents are managed through a defined incident process within our ISMS.
The following are available to support due diligence. Public policies are linked directly; governance documents are available to customers, prospects and auditors on request (those marked confidential under NDA).
Completing a supplier assessment or have a question about how we protect your data? Our team will respond promptly and can provide certificates and governance documents under the usual terms.