Privacy, confidentiality and data handling
Assurance work means holding a client's most sensitive governance material. How that is handled is part of the product, not a policy appendix.
17400724
Eshalu is a trading name of Eshalu Technologies Ltd, registered in England and Wales, company number 17400724. Verifiable on the Companies House public register at find-and-update.company-information.service.gov.uk.
Registered office: 19 Layton Crescent, Slough, Berkshire, SL3 8DP. Our data-processing terms, retention schedule and sub-processor position are provided during due diligence.
Data protection is treated as an operating requirement of the assurance engagement itself — not only as a topic we assess in your AI systems.
ZC225309
Eshalu Technologies Ltd is on the Information Commissioner's Office public register of data protection fee payers. Verifiable at ico.org.uk.
Registration is a statutory notification and a fee. It records who we are and that we have told the regulator we process personal data. It is not a certification, an audit or an endorsement, and we do not present it as one.
What matters in due diligence is the data-processing terms, the retention schedule and the sub-processor position — not the registration number.
ISO/IEC 27001:2022
Eshalu Technologies Ltd is certified to ISO/IEC 27001:2022 for information security management, giving clients added confidence in how we protect information, manage security risk and operate as a trusted AI governance and assurance partner.
Our certified information security management system supports the governance and protection of client information used across assessment, consulting and training engagements.
Certified. Trusted. Ready. Information security is built into how Eshalu operates from the outset.
Client-controlled evidence
Evidence can be uploaded into Eshalu, or recorded as a client-held external reference with reviewer confirmation and the applicable custody status. There is no automated retrieval from your document systems.
No training on client data
Client evidence is never used to train models. AI-assisted analysis is bounded, and a people-only review path remains available for sensitive material.
Human adoption required
AI assistance can accelerate analysis, but nothing becomes a finding, a sufficiency decision or a released report without an authorised human adopting it.
What “independent” means
Reviewed by an authorised Eshalu reviewer who is independent of the work being assessed. If Eshalu materially advises on, designs or helps implement a system or control, Eshalu will not independently assess that same work. This is not a statutory audit and not certification.
Tenant and role isolation
Access is tenant-scoped and role-bound, and narrowed further to the workspace you actually participate in. An identifier belonging to another client is refused exactly as an invented one is — it discloses nothing.
Custody and integrity
Evidence carries a content hash, version and access state. Stored artefacts are re-verified against their recorded hash before they are served; a mismatch is refused rather than rendered.
Disclosure-scoped sharing
External packs are assembled from public-safe content only, and what was withheld is recorded rather than silently dropped.
This website
No forms, no tracking
This site has no forms, no analytics, no advertising trackers and no cookies. Our hosting provider keeps ordinary server request logs — IP address, timestamp and page — to deliver the site and protect it from abuse. If you email us, we hold your message and your contact details for as long as it takes to answer you and to keep a record of the enquiry.
Your rights
You can ask what we hold about you, ask us to correct or delete it, or complain to the Information Commissioner's Office. Contact us at raghu@eshalu.com and we will respond within one month.