Security, data handling and sub-processor information for AUTOM8LABS products.
| Legal entity | AUTOM8LABS LTD |
|---|---|
| Company number | 17073839 (England and Wales) |
| Registered address | Suite 1 Liberty House, South Liberty Lane, Bristol, BS3 2ST, United Kingdom |
| ICO registration | ZC133046 |
| Development | In house, United Kingdom. No outsourced development, no third-party access to source code |
| Security contact | [email protected] |
Our products fall into two groups, with two different data paths. Each product's data sheet says which group it is in and exactly what leaves the workstation.
Products that use your own AI subscription. Our MCP Connectors run on your workstations and talk to the AI provider you already have a contract with. Model data goes to that provider under your contract. AUTOM8LABS is not in that path and never receives it. Whether that data can be used to train models is governed by your provider and the plan your firm uses, not by AUTOM8LABS. Business and enterprise plans generally exclude training. Consumer plans often do not.
Products with AI that AUTOM8LABS operates. Some products send content to an AI provider through a gateway that AUTOM8LABS runs under its own contract with that provider. Only the content needed for the task leaves the workstation. It passes through the gateway without being stored, and the provider processes it under a data processing agreement that excludes model training. The product's data sheet states what is sent, to which provider, and how long the provider keeps it. Today this group is Transl8: the text strings selected for translation go to Anthropic and are deleted within 30 days.
Beyond that, what we receive is limited to licence and version information. Exactly what that means for each product is set out in the data sheets below.
Our MCP Connectors execute instructions generated by an AI model that you choose and operate. AI output can be wrong, and an instruction carried out correctly by the connector can still be the wrong instruction for the project.
All AI-assisted work must be checked and verified by a qualified professional before any deliverable, design decision, or issued drawing relies on it. AUTOM8LABS products are productivity tools. They are not a substitute for professional judgement, engineering validation, or regulatory and contractual verification, and they must not be used as the sole basis for any safety-critical decision.
How each connector limits what the AI can change, and how changes can be reversed, is set out under "How edits are controlled" on each product data sheet.
| ICO registration | Held, ZC133046 |
|---|---|
| Professional indemnity insurance | Held |
| Code signing certificate | Held, AUTOM8LABS LTD via Azure Trusted Signing |
| ISO 27001 | Not held |
| SOC 2 | Not held |
| Independent penetration test | Not commissioned to date |
| Render Services, Inc. | Licence server and Transl8 AI gateway hosting. Licence records and AI usage metadata. Frankfurt, Germany (EEA) |
|---|---|
| Anthropic PBC | AI processing for products with AUTOM8LABS-operated AI, currently Transl8. The content each product sends is stated on its data sheet. United States |
| Stripe, Inc. | Card payments for website purchases. Name, email address and payment details. United States and Ireland |
| Cloudflare, Inc. | Website delivery and security for autom8labs.io, including download and purchase pages. Visitor IP addresses and website form traffic in transit. Global network |
| Autodesk, Inc. | App Store distribution and entitlement for store purchases. United States |
| Google LLC | Encrypted off-site backup of licence records. United States |
| GitHub, Inc. | Private source code hosting and encrypted off-site backup of licence records. United States |
Backups held by Google and GitHub are encrypted before upload with a key held only by AUTOM8LABS. Transfers outside the UK rely on Standard Contractual Clauses with the UK Addendum (Stripe, Anthropic) and on the UK Extension to the EU-US Data Privacy Framework (Cloudflare, Google, GitHub).
Not a sub-processor: the AI provider used by our MCP Connectors. You choose it, you contract with it directly, and your model data goes to it under that contract rather than ours.
Customers with an active commercial relationship are notified before a new sub-processor that would process their data is added.
Send security reports to [email protected]. Reports are acknowledged within two business days. We ask for a reasonable remediation period before public disclosure.
In scope: the AUTOM8LABS products themselves, their installers, and the AUTOM8LABS services they connect to. Out of scope: configuration of this marketing website, including response headers and mail records; social engineering; denial of service; and automated scanner output with no demonstrated impact.
We do not operate a bug bounty and offer no monetary reward. Reporters who want it are credited.
Where an issue materially affects customers, affected customers are notified by email without undue delay and in any case within 72 hours of confirmation. Where an incident is a personal data breach notifiable under UK GDPR, we notify the ICO within 72 hours of becoming aware.
If your review needs something not covered here, including a completed security questionnaire, please email [email protected].