Skip to content
Contact
Trust & securityOur first priority

Trust comes first. Everything is built on it.

Your business isn't just audited against your rules. They're governed by them.

Before we built a single agent, we built the foundation they run on. Compliance sits at its centre: your frameworks, from architecture to ISO standards to your own house rules, shape every plan before any work starts. Security surrounds it, sovereignty decides where it may go, and every step leaves its evidence.

✓ Governed by your frameworks✓ Personal details found first✓ UK & EU by default✓ A receipt for every step
A lighthouse on a rocky shore, its beam cutting across the sky
Needs your yesSend 2 reminder emails
LoggedApproved by Sam Patel · 09:42
Settled once, at the foundation. Everything above inherits it.
SecurityWho may see it
Every record is labelled as it lands, and the label decides who, and which model, may read it.
SovereigntyWhere it may go
Rules, never a model, decide where each piece of work may be stored and run.
ComplianceWhich rules apply
Your frameworks and policies travel with the work into every plan and every check.
CostWhat it may spend
Every step has a budget and a price, agreed before it runs and shown after.
01 · What trust means

Trust is the right answer, every time you ask.

To us, trust means two things. Reliability: the answer you ask for, or the task you hand over, done right. And consistency: give it the same task twice and it does the same thing; ask the same question twice and you get the same answer. That's why we choose determinism over probability. Tested software does the work wherever it can, and a model is trusted only with the judgement in between.

Why it matters
66%of people rely on AI's output without checking it.
56%have made mistakes at work because of AI.
KPMG and the University of Melbourne, Trust, attitudes and use of AI: a global study, 2025. 48,000 people in 47 countries.
01 Reliable The answer you asked for, or the task you gave, done properly and checked against your rules before it reaches you.
02 Consistent The same task twice takes the same steps under the same rules. Once an answer is verified, the same question gets the same answer.
03 Deterministic first Software wherever it can, a model only where judgement is needed, and never a bigger one than the job needs.
04 Accountable Every step leaves a receipt: who asked, which rules applied, what ran, where, and what it cost.
One task, run three timesPost Sam's train ticket to Leeds · £86.40
Three runs
AI on its ownA fresh guess each time it runs
CategoryCost centreSign-off
Run 1TravelSalesNone
Run 2TravelMarketingNone
Run 3MealsSalesManager
Three runs, three different answers
MindLynxYour playbook, checked against your expenses policy
CategoryCost centreSign-off
Run 1TravelSalesNone
Run 2TravelSalesNone
Run 3TravelSalesNone
Three runs, one answer · Expenses policy v3 ✓
✓ Every answer that proves itself becomes software. Once a person verifies how a question is answered, the next run follows that verified method instead of making a fresh guess, and the receipt says who verified it, and when.
02 · Compliance, first class

Governed by your frameworks, not just audited against them.

More and more of how a business runs is being handed to AI, and most of it is checked after the event: the work happens, then someone goes looking for evidence. We turned that round. Every agent works inside a harness: the playbook it follows, the checks it must pass and the evidence it must leave. Your own rules, processes and rigour, and the frameworks you answer to, are written into that harness. They shape the plan before work starts, every gate checks them, and the evidence is written as the work happens.

Official compliance
The standards and laws your industry answers to, applied to every piece of work they touch.
ISO/IEC 27001ISO/IEC 42001SOC 2UK GDPRDORAEU AI Act
Architecture
How your systems should be designed and changed, with the records kept current as they change.
TOGAFC4Your reference architecture
Your own rules
The way your business already works: who approves what, what good looks like, and what must never happen.
Approval limitsPoliciesBrandHouse standards
To Helix, a control, a quality standard and a house rule are the same thing: something the work is checked against. So an ISO clause, a TOGAF phase and your approval limit can govern the same piece of work, side by side.
Every action has a delivery lifecycle. Every department has work to deliver, plans to make and KPIs to reach, with functional and non-functional requirements behind each one. So every action runs the same lifecycle. Apply a framework to a playbook once, and its evidence lands in the right stage of every run.
Pay a new supplier Playbook · Procurement v4 Governed byISO/IEC 27001Your finance policy
Plan
Supplier checked and risk assessed ISO 27001 · 5.19
Do
Bank details confirmed by call-back Finance policy · 4.2
Check
Second approver over £10,000 Finance policy · 2.1 A person signs this stageWaiting for a second approverApproved by Priya Shah · 10:14
Release
Payment released and reconciled Finance policy · 6.3
Sustain
Supplier reviewed every year ISO 27001 · 5.22
Evidence 5 of 5
✓ Records updated · the same steps on every run
When evidence is missing, the gate stays shut.Overriding a mandatory check takes a named person, a reason and an accepted risk, and the override expires. Nothing is silently skipped.
Proof that controls held, not just that they exist.Most tools gather evidence afterwards, from the outside. Here the work writes its own evidence as it runs, so the records stay current and show each control held, run by run.
Examples are illustrative. References are to ISO/IEC 27001:2022 and ISO/IEC 42001:2023 Annex A, and to the TOGAF Architecture Development Method.
03 · Security by design

Compliance at the centre. Security all around it.

Security, cyber security included, isn't a layer we added at the end. It surrounds every step, and it starts with the most sensitive thing you hold: information about people. We keep it apart, reduce the risk, and prove what happened.

Personal details found first Every record is checked as it arrives, including combinations that could identify someone, and details are masked before any model reads the work.
Kept apart by class Personal, financial and health data each have their own keys, and the label travels with the data, so it can't be quietly relabelled.
Least privilege People and agents see only what they're allowed to see, and every connection starts read-only.
Fails closed If a rule can't be checked, or nowhere allowed is available, the work stops and says why. It never falls back to somewhere less strict.
Defences built for AI What arrives in documents, emails and web pages is treated as information, never as instructions, and memories keep a record of where they came from.
Encrypted throughout In transit and at rest, with keys managed for each class of data and rotated at least every year.
A record that can't be rewritten Every step is written once to an append-only record: who asked, which rules applied, what ran and where.
Tested and watched Continuous monitoring, regular testing, and a clear route for anyone to report a weakness to us.
You decide how far agents go. Every connection starts read-only. You widen what agents may do one step at a time, system by system, and you can narrow it again with one click.
It can
✓Read connected systems within each person's permissions
✓Answer questions, citing every source
It cannot
✕Change, send, post or pay anything
What you seeEvery answer shows where it came from. This is where every connection starts.
04 · Sovereignty

Sovereignty is more than where the server sits.

We define sovereignty in three layers: the country whose law applies, the company that owns the work, and the person the information is about. Each layer has a degree of control, a degree of residency (where data is stored and processed) and a degree of ownership. Together, that is sovereignty.

UK lawEU lawWherever you trade
Your frameworksYour playbooksYour data
Sam Patela model seesPerson A
ControlUsed for payroll, with consent
ResidencyKept in the UK
OwnershipCan see, correct or erase it
CountryWhose law applies
ControlYour business is governed by the law of the country that owns it, and by every law that reaches its work. Those rules are applied before anything moves.
ResidencyStored and processed in the UK and EU by default. Personal and confidential work stays in its home jurisdiction.
OwnershipWho owns the infrastructure matters as much as where it is, because an operator owned abroad can be compelled by its home country's law. We name the operator of every place your data can go.
Law is a filter, never a score.
Where your work runs is decided by rules, never by a model. The law removes places first; only then do cost and speed choose among what's left. If nowhere is allowed, the work is refused, and the refusal is recorded.
Learn more about sovereignty →See private LLM options →
05 · Assurance

Proof you can check, not promises you have to take.

Trust has to be checkable. Everything here leaves evidence that your auditors, your regulators and your own teams can read for themselves.

Evidence packs on demand Choose a framework and a period, and get every control with the runs that evidence it, ready for your auditor.
Documents that stay true Policies, registers and architecture records update as the work changes, so nothing we know has changed sits contradicted by its document.
A receipt for every step "Every confidential step ran in the UK" is a question you can ask the record, not a claim you have to accept.
Models that declare themselves Every Albion model card names its base, its teachers and its scores, including the ones it loses.
A person behind every exception Approvals, overrides and exceptions are named, timed and kept, so accountability always ends with a person.
Tell us what you find Found a weakness? Report it to us. We'll respond, fix it and keep you updated.
The standards we build toWe'll publish each certificate here with its scope as it's awarded, alongside the subprocessors we use.
ISO/IEC 27001:2022ISO/IEC 42001ISO/IEC 27701SOC 2 Type IICyber Essentials PlusNCSC Cloud Security PrinciplesETSI EN 304 223UK GDPREU AI Act
06 · Questions

What security teams ask us.

Need more for your due diligence? Our security pack covers our controls, the places we process data, our subprocessors and how we handle incidents.

Request our security pack
In the UK and EU by default. Every place we use is described by its jurisdiction, who operates it and who holds the keys, and you can narrow it further. Larger organisations can run MindLynx inside their own environment.

Built to be trusted with what matters most.

Bring us your frameworks, your rules and the places your work may go. We'll show you the evidence, run by run.