Trust
Security. What we do with client data.
Immigration files hold some of the most sensitive data a person has. This is how we look after it, and how to tell us if we've got something wrong.
What Bainary does, and doesn't
- Fills the GOV.UK form and stops at Check your answers. It never signs the declaration, pays a fee or submits.
- Every extracted fact links to the document and page it came from, so a solicitor can check it in seconds.
- Gaps and conflicts come back to the solicitor as questions. Nothing is guessed.
- Gives no legal or immigration advice. The firm stays the regulated adviser.
Client data
- Stored in London, encrypted in transit and at rest.
- Processed only by the sub-processors named in our data processing agreement, each under a data protection agreement. We email firms before any change.
- Uploaded documents are deleted when filing completes. A firm can delete any matter, and everything in it, at any time.
- We don't use client data to train AI models.
- Each filing run is isolated from other matters and can reach only the services it needs.
Contracts and certification
- Our data processing agreement (UK GDPR Article 28) is public. A fuller security summary for due diligence is available on request: security@bainary.ai.
- We don't hold Cyber Essentials or ISO 27001 yet. Cyber Essentials is next.
If something goes wrong
- We tell affected firms within 48 hours of becoming aware of a personal data breach, and help them meet their own duty to the ICO.
- We publish a post-mortem for any incident that affects client data.
Reporting a vulnerability
- Email security@bainary.ai with the steps to reproduce. We reply within three working days and keep you updated until it’s fixed.
- Act in good faith: don't access or change client data beyond what you need to show the issue, don't degrade the service, and don't use social engineering. If you do that, we won't pursue you.
- We don't run a paid bug bounty, but we'll credit you if you'd like.