Legal
Data protection
This page sets out how data protection is applied in practice inside Artery. It sits alongside the privacy policy and the data-processing agreement issued with the beta agreement.
1. Roles
For personal data held in the application, the customer firm is the data controller and Artery is the processor. We process that data only on the customer’s documented instructions, and for the purpose of operating the coordination service.
2. Principles applied
- Data minimisation — only the personal data needed to attribute an action and route a request is collected.
- Purpose limitation — data is used to operate the service. It is not resold, profiled or repurposed.
- Integrity — decisions carry a SHA-256 content hash, and corrections are appended as new events rather than silent rewrites.
- Storage limitation — records are retained for the life of the engagement and handled on exit per contract.
3. Nature of the personal data
Personal data on the platform is largely professional contact and action data: who at which firm did what, and when. It is deliberately narrow, and it exists because the audit trail is the product.
4. Security measures
- Hosting within the European Union, with no default transfer outside it.
- Encryption in transit and at rest, with keys managed by the hosting platform.
- Row-level access control enforced in the data layer, so an interface mistake cannot widen what an organisation can read.
- Logical separation of each organisation’s workspace, with cross-organisation access only where an engagement has been proposed and accepted.
- Authentication with per-organisation membership and role-based permissions, and every action attributed to a named user acting for a named organisation.
Artery holds no external security certification today and does not imply one. Formal assurance work is planned as the customer base grows and will be named only once completed.
5. Sub-processors
We use a small number of sub-processors for hosting, database and transactional email, all within the EU. The current list is provided on request as part of diligence, and customers are notified before a new sub-processor is added.
6. Subject rights
Access, rectification and erasure requests are supported, balanced against the record-keeping obligations of the customer firms. Where we receive a request directly for data we process on a customer’s behalf, we route it to that customer and assist them in responding.
7. Incidents
Suspected personal-data breaches are investigated immediately and affected customers are notified without undue delay, with the facts known at the time and the steps taken.
8. Requests and diligence
Send your data-protection questionnaire or DPA request to support@tibmont.com and we will complete it.