Security, data handling and sub-processor information for AUTOM8LABS products.
| Legal entity | AUTOM8LABS LTD |
|---|---|
| Company number | 17073839 (England and Wales) |
| Registered address | Suite 1 Liberty House, South Liberty Lane, Bristol, BS3 2ST, United Kingdom |
| ICO registration | ZC133046 |
| Development | In house, United Kingdom. No outsourced development, no third-party access to source code |
| Security contact | security@autom8labs.io |
Our MCP Connectors run on your own workstations and use your own AI subscription. Model data goes to the AI provider you already have a contract with. AUTOM8LABS is not in that path and never receives it.
Your provider's terms apply. Whether data your team sends can be used to train models is governed by your AI provider and the plan your firm uses, not by AUTOM8LABS. Business and enterprise plans generally exclude training. Consumer plans often do not.
What we do receive is limited to licence and version information. Exactly what that means for each product is set out in the data sheets below.
| ICO registration | Held, ZC133046 |
|---|---|
| Professional indemnity insurance | Held |
| Code signing certificate | Held, AUTOM8LABS LTD via Azure Trusted Signing |
| ISO 27001 | Not held |
| SOC 2 | Not held |
| Independent penetration test | Not commissioned to date |
| Render Services, Inc. | Licence server hosting. Licence records. Frankfurt, Germany (EEA) |
|---|---|
| Stripe, Inc. | Card payment processing for website purchases only |
| Autodesk, Inc. | App Store distribution and entitlement checks for store purchases |
| Google LLC | Encrypted off-site backup of licence records |
Not a sub-processor: the AI provider used by our MCP Connectors. You choose it, you contract with it directly, and your model data goes to it under that contract rather than ours.
Customers with an active commercial relationship are notified before a new sub-processor that would process their data is added.
Send security reports to security@autom8labs.io. Reports are acknowledged within two business days. We ask for a reasonable remediation period before public disclosure.
In scope: the AUTOM8LABS products themselves, their installers, and the AUTOM8LABS services they connect to. Out of scope: configuration of this marketing website, including response headers and mail records; social engineering; denial of service; and automated scanner output with no demonstrated impact.
We do not operate a bug bounty and offer no monetary reward. Reporters who want it are credited.
Where an issue materially affects customers, affected customers are notified by email without undue delay and in any case within 72 hours of confirmation. Where an incident is a personal data breach notifiable under UK GDPR, we notify the ICO within 72 hours of becoming aware.
If your review needs something not covered here, including a completed security questionnaire, please email security@autom8labs.io.