1. Purpose and scope

This document describes security and data handling arrangements for Compliance Studio.

It supports customer procurement, IT security, quality and data protection assessments. It provides an overview of the service rather than a detailed security architecture, penetration test report or certification statement.

Contractual commitments and the processing of personal data on behalf of customers are addressed in the applicable Terms and Conditions and data processing provisions.

2. Information processed and intended use

Compliance Studio supports regulatory professionals in establishing and maintaining Regulatory Positions for products and companies across markets.

Information processed through the service includes:

• User email addresses and authentication information.

• Project membership and access permissions.

• Product, company and market information.

• Regulations Register entries, applicability assessments, rationale and associated history.

• Comments and other information submitted by users.

• Studio Agent inputs, relevant contextual information and generated outputs.

• Technical information required to operate and secure the service.

Customer information may be commercially confidential even where it contains no personal data.

The service is not intended for patient records, clinical trial subject data or other sensitive health information. Users should limit personal data in customer content to what is necessary for their regulatory work.

The system’s intended use and boundaries are described in System overview & intended use.

3. Hosting and processing locations

Compliance Studio’s production application and database are hosted on Amazon Web Services within the European Union.

EU hosting of the primary application does not mean that all processing takes place within the EU. AI processing, external authentication and payment services involve additional providers whose processing arrangements differ from those of the primary hosting environment.

Relevant providers and their functions are described in section 6. Information concerning personal data recipients and international transfers is addressed in the Privacy Policy and applicable data processing documentation.

4. Authentication and access control

User authentication

Users can authenticate using email and password or supported external identity providers, including Google, Microsoft and LinkedIn.

Compliance Studio does not currently provide its own two-factor authentication for email-and-password login. Additional authentication controls may be available through the user’s external identity provider, depending on that provider’s configuration.

Following authentication, the service uses JSON Web Tokens to identify the user and evaluate access to requested resources.

Project permissions

Access to project information is checked at the API level for each request. Requests are evaluated against the authenticated user’s project membership and permission level.

A user requesting information from a project to which they do not have access is denied access.

Customers are responsible for assigning appropriate project access and reviewing membership when responsibilities change.

Administrative access

Administrative access to AWS is protected by two-factor authentication.

Designated Hoodin technical personnel can access production information for service operation, maintenance and troubleshooting. Infrastructure administration privileges may also permit access to production data.

Administrative access is separate from the permissions available to ordinary customer users.

5. Encryption and technical protection

Production data is encrypted at rest using AES-256. Production communications are protected in transit using TLS.

Encryption complements access controls; it does not prevent access by personnel or services with the necessary authorisation and technical privileges.

Hoodin does not currently offer customer-managed encryption keys.

6. AI services and other third-party providers

These providers do not necessarily have the same data protection role. The applicable role depends on the processing performed.

OpenAI processing

Compliance Studio sends information to OpenAI to provide AI-supported functionality. Information entered elsewhere in the relevant regulatory context may therefore be included in an AI request where required by the function.

Optional OpenAI data-sharing settings are disabled. Customer inputs and outputs are not shared with OpenAI for model training through those optional settings.

The service currently uses the Responses API without explicitly disabling response storage. OpenAI may therefore retain response data and associated logs under the applicable API retention arrangements. Disabled model-training sharing does not mean that no provider-side storage occurs.

R deletion from Compliance Studio does not itself establish that every corresponding provider-side record has been deleted. Provider-side retention and deletion must be considered under the applicable service arrangements.

Changes to AI providers or material processing arrangements are subject to applicable contractual and data protection requirements, including relevant customer information and authorisation provisions.

Analytics and external websites

Compliance Studio does not currently use Google Analytics or cookies.

Google Analytics is used on the external website. External websites, contact forms, identity providers and payment pages have separate processing arrangements and are outside this statement about analytics and cookies within Compliance Studio.

7. Retention, account status and deletion

Downgrading from a paid subscription to freemium does not close the user account.

Compliance Studio does not currently provide self-service account deletion. Users can request account closure or deletion through Contact Hoodin. Requests are handled manually.

Hoodin checks the requester’s identity and authority as appropriate to the request. Closing an individual account must be distinguished from deleting a shared project or information controlled by a customer organisation.

Ending a paid subscription does not itself trigger deletion of the account or project information. For freemium accounts that have been inactive for 12 months, Hoodin will send an email asking whether the user wishes to retain the account. Unless the user logs in or confirms within 30 days, the account will be closed and deleted. Shared project information will be assessed separately to avoid affecting other users.

For personal data, continued retention must have an applicable purpose and legal basis. Information about retention criteria, rights and applicable exceptions is provided in the Privacy Policy and relevant data processing provisions.

Deletion from active systems is distinct from expiry of backup copies and provider-side records. Information that must be retained for a legal obligation is handled separately from information no longer required for the service.

8. Backup, recovery and availability

Database backups are performed daily using AWS snapshots. Backups are retained for a limited period to support recovery.

The database restoration procedure has been tested. This statement concerns testing of the restoration procedure and does not represent a guarantee of uninterrupted availability or recovery within a specified time.

Recovery depends on the nature of the disruption, available recovery points and the affected infrastructure.

Specific availability commitments, recovery objectives or service levels apply only where expressly agreed. Customers should consider their own continuity and record-retention needs when determining how to use and retain outputs from Compliance Studio.

9. Security incidents and customer communication

Suspected security issues, unauthorised access or possible exposure of customer information should be reported through Contact Hoodin.

Reports should identify the affected account or project, the approximate time, the observed issue and any known consequences. Passwords and unnecessary confidential information should not be included.

Hoodin assesses reported issues and coordinates the relevant technical investigation and customer communication. Notification responsibilities depend on the incident, Hoodin’s data protection role and applicable legal and contractual requirements.

Where Hoodin acts as a processor, personal data breach notification to the customer is governed by the applicable data processing provisions. This document does not establish a separate support response time or incident-resolution guarantee.

10. Responsibilities and supporting documentation

Hoodin is responsible for operating and maintaining the service within its defined scope and applicable commitments.

Customers are responsible for:

• Assigning and maintaining appropriate user access.

• Protecting credentials and configuring external authentication appropriately.

• Ensuring that information entered into the service is suitable for its intended scope.

• Limiting unnecessary personal data.

• Managing the review and controlled use of regulatory outputs.

• Communicating authorised requests concerning shared project information.

Further assessment information can be requested through Contact Hoodin.

This document should be read alongside:

• System overview & intended use.

• AI Literacy Statement.

• Validation approach for Compliance Studio.

• Privacy Policy.

• Terms and Conditions and applicable data processing provisions.

• Vendor information & assessment resources.

Document revision history