Privacy, confidentiality and data handling
Assurance work means holding a client's most sensitive governance material. How that is handled is part of the product, not a policy appendix.
ZC134750
Eshalu is registered with the Information Commissioner's Office as a data controller. Verifiable on the ICO's public register at ico.org.uk.
Full registration detail, our data-processing terms, retention schedule and sub-processor position are provided during due diligence.
Data protection is treated as an operating requirement of the assurance engagement itself — not only as a topic we assess in your AI systems.
Client-controlled evidence
Evidence can be uploaded into Eshalu, or recorded as a client-held external reference with reviewer confirmation and the applicable custody status. There is no automated retrieval from your document systems.
No training on client data
Client evidence is never used to train models. AI-assisted analysis is bounded, and a people-only review path remains available for sensitive material.
Human adoption required
AI assistance can accelerate analysis, but nothing becomes a finding, a sufficiency decision or a released report without an authorised human adopting it.
What “independent” means
Reviewed by an authorised Eshalu reviewer who sits outside the client team responsible for designing or operating the AI system. It is not a statutory audit and not a certification, and we do not describe it as either.
Tenant and role isolation
Access is tenant-scoped and role-bound, and narrowed further to the workspace you actually participate in. An identifier belonging to another client is refused exactly as an invented one is — it discloses nothing.
Custody and integrity
Evidence carries a content hash, version and access state. Stored artefacts are re-verified against their recorded hash before they are served; a mismatch is refused rather than rendered.
Disclosure-scoped sharing
External packs are assembled from public-safe content only, and what was withheld is recorded rather than silently dropped.
This website
No forms, no tracking
This site has no forms, no analytics, no advertising trackers and no cookies. Our hosting provider keeps ordinary server request logs — IP address, timestamp and page — to deliver the site and protect it from abuse. If you email us, we hold your message and your contact details for as long as it takes to answer you and to keep a record of the enquiry.
Your rights
You can ask what we hold about you, ask us to correct or delete it, or complain to the Information Commissioner's Office. Contact us at raghuram.saripalli@saisaripalli.com and we will respond within one month.