Hosted in Zurich. Checked at every step.
How Sumarity looks after your data and your decisions. If your security team has a questionnaire, send it to us.
Security and control
| Where it runs | Google Cloud, Zurich (europe-west6). Your data, backups and logs are stored in Switzerland.A dedicated deployment in the EU or in your own cloud is available. |
| Numbers | Never from a model.Code works out every amount and date. The validator refuses a workflow that would take a number from a model. |
| Changes | Only by publishing.A workflow changes only when an admin publishes a new version. Tuning proposes; people decide. |
| Access | Roles, separation of duties, four eyes.Rights by role; no one approves their own work; a second person for material items. |
| Records | Every call on record.What the engine saw, how sure it was, which version, who reviewed it. Run reports and an evidence pack per period. |
| Backups | Nightly, in Zurich.Database backups each night to storage in Zurich, and daily disk snapshots. |
| Infrastructure | Encrypted in transit and at rest.HTTPS everywhere; administrative access only through Google's identity-aware proxy, with no open SSH. |
Our certification programme
| UK Cyber Essentials | For UK customers and their insurers. |
| SOC 2 Type I and Type II | Controls examined by an independent auditor. |
| ISO/IEC 27001 | Information security management. |
| ISO/IEC 42001 | AI management: how AI is governed, measured and overseen. |
Each report and certificate is published here when it's issued.
The EU AI Act
Most of Sumarity's work (reconciliation, matching, filings, claims handling) is not a high-risk use under the EU AI Act. A few library workflows can be, when a customer runs them on people: benefit eligibility, the creditworthiness of individuals, and employment checks. Those workflows are marked in the library. For them, Sumarity provides what the Act asks for: human oversight on every uncertain call, a record of every decision, and documentation of how each judgement is checked and measured.
Paper for your procurement team
Our terms, data processing agreement and list of sub-processors are sent on request and published here. Report a security issue to hello@sumarity.ai; we reply within one business day.