AI is only useful if you can trust what it does with your data. As an AI consultancy and engineering firm, 53d North runs an ISO/IEC 27001-certified information security management system and holds Cyber Essentials certification. Our CTO is also our named Data Protection Officer. Security and data protection are designed into everything we assess, build, deploy and scale.
Certification means an outside body has checked that our controls exist and work, and that we keep improving them. It's also the first thing your procurement and security teams will ask about.
The international standard for information security management. Our ISMS sets out how we identify and manage risk across people, processes and technology, and it's audited regularly by an independent certification body.
The UK government-backed scheme, run with the NCSC, that covers the technical controls preventing the most common cyber attacks. Many UK public sector and enterprise contracts require it.
Six principles apply to every engagement, from a one-day assessment to a system we run for you.
Your data, and everything built from it, stays yours. We act as your data processor, under a written data processing agreement.
We ask for the least data a job requires. Assessments and code audits don't need your production data at all.
Data is hosted in the UK by default and only ever in the UK or EEA. You'll know exactly where, before anything is built.
Each client's data is kept separate from every other client's, and encryption keys are held by us, not by third parties.
Retention periods are agreed up front and deletion is automated. When an engagement ends, your data is returned or securely deleted.
Data protection impact assessments, records of processing and audit trails are kept, so every decision can be explained later.
This is the question we're asked most, so here's a straight answer. The same rules apply whether the model is a commercial service or one we host ourselves.
AI law is changing fast, and it applies to the businesses that use AI as well as those that build it. We design every system so you can meet your obligations under the EU AI Act and UK data protection law, and so you can show that you have.
Dates below are correct as at November 2026. This is a summary, not legal advice.
Applies to UK businesses too, wherever an AI system is used in the EU or its output affects people there. It sorts AI into risk levels, with duties that grow with the risk.
The UK has no single AI Act. AI is regulated through existing law and by sector regulators such as the ICO, the FCA and Ofgem.
A summary of the controls our ISMS covers. The full policies are available to clients and prospective clients under NDA.
Every incident follows the same rehearsed process, led by a named incident lead. The green steps are human decisions, not automated ones.
Monitoring and alerts, reports from staff, clients or researchers
A named person judges severity and impact, and takes charge
Access revoked, systems isolated, or the AI switched off with its kill switch
You're told within the time agreed in your contract, and the ICO within 72 hours where the law requires it
Root cause found, fixed and fed back into the ISMS
We regularly complete supplier security questionnaires and due-diligence requests for large enterprise customers, including global automotive manufacturers. Ask, and we'll send what you need.
Thank you. Please email hello@53dnorth.com with "Security" in the subject line, and include enough detail for us to reproduce it.
We'll acknowledge your report within 3 working days and investigate within 5. Please give us reasonable time to fix the issue before telling anyone else about it. We won't take action against anyone who reports in good faith.
No. We only use AI services on business terms that exclude training on your data, or models we host ourselves. Your data is never shared between clients.
In the UK by default, and only ever in the UK or EEA. You'll know exactly where before anything is built.
Yes. Our information security management system is certified to ISO/IEC 27001, and we hold Cyber Essentials certification. Certificates are available on request.
We design every system so you can meet your obligations: risk classification at the start, transparency, human oversight, logging and documentation. We're engineers, not lawyers, so we'll work alongside your legal advisers where you need formal advice.
Email hello@53dnorth.com with "Security" in the subject. We acknowledge reports within 3 working days and investigate within 5.
Your question will be answered by the people who run our ISMS and design our systems, not by a sales team reading a script.