Security and data handling.
Protecting information is part of how Amaea is built and operated. This page explains the safeguards on amaea.co.uk and the platform controls relevant to a firm’s review.
1. The website and your client information
The public website provides product information, walkthroughs and enquiries. It does not provide access to your firm’s client records. The document selector in a walkthrough keeps the selected file on your device and does not upload it. Please do not include real client details, account passwords or documents in public enquiries.
Client information in the app is handled under the arrangements agreed with your firm. Our website privacy notice covers information provided through this website and our enquiry correspondence.
2. Secure connections and browser protections
The website uses HTTPS. Its responses include a transport-security policy that directs compatible browsers to use secure connections, and browser security headers that restrict how the page can be embedded, how content is loaded and how browser features are used.
These safeguards help reduce common web risks. They work alongside application checks and ongoing maintenance; they are not a guarantee that every security risk has been eliminated.
3. Enquiry safeguards
Enquiry submissions are checked for valid fields and size, cross-site submissions and repeated requests. Automated spam indicators and rate limits help protect the form from abuse. Enquiries are delivered to the Amaea team’s inbox through the email provider.
Application delivery logs record a reference, delivery identifier and status rather than the submitted message, email address or firm name. Our hosting provider separately handles technical network and security information. More detail is in the privacy notice.
4. Platform access and firm separation
The app includes authenticated access, firm-scoped access checks and database row-level security to restrict records to the relevant firm. Automated integration checks exercise cross-firm reads and writes, including document embeddings. These checks support ongoing security review and do not replace independent assurance.
Integration credentials are encrypted before storage using AES-256-GCM. Access to customer data, user permissions and the applicable processing arrangements should be reviewed with your firm during onboarding.
5. Hosting, providers and data locations
The website uses Vercel for hosting, Resend for enquiry-email delivery and Google Workspace for team correspondence. Calendly provides the optional demo calendar, which loads only after a visitor chooses it. The plan guide does not send its answers to an external service. The app uses Supabase for database, authentication and document storage, Anthropic for AI processing, and Voyage for embeddings.
Provider processing may take place outside the UK. For example, Resend states that email content and delivery records are stored in the United States. The website does not claim that all information remains in the UK or EU. Our privacy notice links to the relevant website-provider processing information.
Ask us about the hosting regions, sub-processors, international-transfer safeguards and AI-processing arrangements applicable to your firm’s proposed service. These should be considered before client information is supplied.
6. Due diligence and assurance
Discuss the evidence your firm needs, including access controls, data handling, backup and recovery arrangements, incident response, export and deletion. Service levels and customer commitments belong in the written service agreement and data processing agreement.
This website does not publish an independent security certification or penetration-test attestation for Amaea. Automated checks and a provider’s certifications should not be treated as a certification held by Amaea.
7. Reporting a security concern
Email security@amaea.co.uk or hello@amaea.co.uk. Include the affected URL, a description and steps to reproduce the issue if it is safe to do so. Avoid real client information, passwords or unnecessary personal details.
If a report involves sensitive evidence, contact us first to arrange an appropriate way to share it. Please do not access another person’s records or disrupt the service while investigating.