Trust & Security
The policies behind the platform, for the security and compliance teams reviewing us.
Last updated October 21, 2026
Policies
How we protect your data, keep the service running and do business responsibly.
Security
Information Security Policy
This Information Security Policy establishes the governance, principles, and minimum control requirements for protecting Subcontext Ltd ("Subcontext") information assets.
Version 1 · Updated October 21, 2026 Read the policyIncident Response Plan
This plan establishes procedures for detecting, responding to, and recovering from security incidents affecting Subcontext systems, data, or services. Its aims are to limit harm...
Version 1 · Updated October 21, 2026 Read the policyVulnerability Management Policy
This policy establishes Subcontext's approach to identifying, assessing, and remediating security vulnerabilities. It makes sure weaknesses in our code, dependencies, container...
Version 1 · Updated October 21, 2026 Read the policyAccess Control Policy
This policy establishes access control requirements for Subcontext systems and data. It sets out who may access what, how that access is granted, authenticated, reviewed and...
Version 1 · Updated October 21, 2026 Read the policyChange Management Policy
This policy establishes the process for managing changes to the Subcontext platform, infrastructure, and configuration. Its aim is to make sure every change to production is...
Version 1 · Updated October 21, 2026 Read the policyVulnerability Disclosure Policy
We welcome reports from security researchers who find vulnerabilities in Subcontext. This policy explains what is in scope, how to report a vulnerability, and what you can...
Version 1 · Updated October 21, 2026 Read the policySecure Development Policy
This policy sets out how Subcontext designs, builds, tests and releases software so that security is built in from the start. It applies the principle that security problems are...
Version 1 · Updated October 21, 2026 Read the policyEncryption & Key Management Policy
This policy sets out how data is encrypted in transit and at rest, and how encryption keys and secrets are managed. Encryption protects data if it is intercepted on the network...
Version 1 · Updated October 21, 2026 Read the policyLogging & Monitoring Policy
This policy sets out what Subcontext logs, how long logs are kept, how they are protected and how they are monitored. Good logging lets Subcontext detect and investigate...
Version 1 · Updated October 21, 2026 Read the policyStaff Security Policy
This policy sets out the security responsibilities of everyone who works for or with Subcontext, from joining to leaving.
Version 1 · Updated October 21, 2026 Read the policyData protection
Data Classification Policy
This policy defines how Subcontext classifies data and the controls applied at each classification level. Classifying data consistently means everyone handling it knows how...
Version 1 · Updated October 21, 2026 Read the policyData Retention & Deletion Policy
This policy defines retention periods for data processed by Subcontext and the procedures for secure deletion. It puts into practice the storage limitation principle of the UK...
Version 1 · Updated October 21, 2026 Read the policySub-Processor List
The following third-party sub-processors are engaged by Subcontext Ltd to process data on behalf of customers.
Version 1 · Updated October 21, 2026 Read the policyData Subject Rights Procedure
This procedure explains how requests from individuals to exercise their rights under the UK GDPR are handled: access, rectification, erasure, restriction, portability and...
Version 1 · Updated October 21, 2026 Read the policyData Protection Impact Assessment
This is Subcontext's assessment of the data protection risks of the platform's core processing: AI agents holding conversations with our customers' customers, and the CRM and...
Version 1 · Updated October 21, 2026 Read the policyTransfer Risk Assessment
Some of Subcontext's sub-processors process personal data in the United States. This assessment records how those restricted transfers are made lawful under the UK GDPR, and why...
Version 1 · Updated October 21, 2026 Read the policyResilience & operations
Business Continuity & Disaster Recovery Policy
This policy establishes Subcontext's approach to maintaining service availability and recovering from disruptive events. It sets out how the platform is built to withstand...
Version 1 · Updated October 21, 2026 Read the policyExit Plan & Data Return Policy
This policy explains how a customer can leave Subcontext in an orderly way: how they get their data back, how we support the move to another provider, and how their data is...
Version 1 · Updated October 21, 2026 Read the policyOperational Resilience Statement
Many of our customers are regulated firms that must keep their important business services within impact tolerances, including under the FCA's and PRA's operational resilience...
Version 1 · Updated October 21, 2026 Read the policySupplier Risk Management Policy
This policy sets out how Subcontext selects, contracts with and monitors the suppliers and sub-processors that the platform depends on, so that the risks they bring are...
Version 1 · Updated October 21, 2026 Read the policyService Levels & Support Policy
This policy sets out the availability we aim for, how customers get support, and how quickly we respond.
Version 1 · Updated October 21, 2026 Read the policyResponsible business
AI Ethics & Responsible Use Policy
This policy establishes Subcontext's principles and commitments for the ethical and responsible development and deployment of AI systems.
Version 1 · Updated October 21, 2026 Read the policyModern Slavery Statement
This statement is made pursuant to Section 54 of the Modern Slavery Act 2015 and sets out the steps Subcontext Ltd has taken to ensure that modern slavery and human trafficking...
Version 1 · Updated October 21, 2026 Read the policyComplaints Handling Policy
This policy sets out how Subcontext handles complaints from customers, end users, and other stakeholders.
Version 1 · Updated October 21, 2026 Read the policyAnti-Bribery & Corruption Policy
Subcontext has zero tolerance for bribery and corruption. We comply with the Bribery Act 2010, and expect the same of everyone who works for or with us.
Version 1 · Updated October 21, 2026 Read the policyWhistleblowing Policy
Subcontext wants anyone who works with us to feel able to raise concerns about wrongdoing, knowing they will be taken seriously and that they are protected under the Public...
Version 1 · Updated October 21, 2026 Read the policyConflicts of Interest Policy
This policy makes sure personal interests never improperly influence decisions made for Subcontext or its customers.
Version 1 · Updated October 21, 2026 Read the policyEquality, Diversity & Inclusion Policy
Subcontext is committed to equality of opportunity, and to a workplace where everyone is treated with dignity and respect. We comply with the Equality Act 2010.
Version 1 · Updated October 21, 2026 Read the policyEnvironmental Statement
Subcontext is a software company, so our environmental impact comes mainly from the computing that runs our platform, our equipment and our travel. We aim to keep it low and to...
Version 1 · Updated October 21, 2026 Read the policyEnterprise Order Form
Fixed-term and negotiated plans are agreed on an Order Form under our Terms of Service. Here is the template we use.
Questions from your security or procurement team?
We're happy to answer questionnaires and talk through any of these policies.