Built to be trusted with client data.
Every firm's data is isolated, encrypted, never sold, and shared only with the providers that run the service. Every draft waits for an adviser. And the evidence a compliance review asks about is recorded as you work.
Per-firm data isolation
Row-level security means each user sees only their own clients and cases within their firm, and a colleague sees a client only where it has been shared with them, read-only.
Encrypted in transit and at rest
Encrypted in transit (TLS) and at rest by our infrastructure providers.
Adviser review before finalise
The AI drafts, a broker approves - never an automated decision. Nothing is finalised without a human reviewing it first.
Owner, admin and member roles
Every account has owner, admin and member roles, so you decide who can do what within your firm.
Data residency
Client records, documents and transcripts are stored in the EU (Ireland), with UK data-transfer safeguards for AI drafting.
Retention & deletion
Documents stay on the client's file until you delete them, the client is erased, or your firm's retention schedule removes them. The schedule's default for the files of ID, income and bank documents, such as payslips and bank statements, is 6 years after completion, with 30 days' notice, and the record that each was received is kept. A document held for sensitive details is deleted at the end of your firm's window (14 days unless you change it) unless an adviser keeps it; the temporary copy made to read one is deleted as soon as it has been read. Meeting audio is deleted after transcription by default.
Your data is never used to train AI models. The full list of who processes it, and where, is on our sub-processor list.
The record a compliance review needs, there by default.
Crestwell is not your compliance department. Your firm answers to the FCA and the ICO; Crestwell's job is to make sure that when a file is reviewed, everything it should contain is on it: where each fact came from, who checked it, who signed it, who looked at it since.
Every fact shows where it came from
Each extracted field carries its source: the transcript quote, with a timestamp on recorded meetings, or the document it was read from. You accept or reject what the meeting gave, and confirm each page of what the documents gave. The fact find and file note stay drafts until you sign them off.
An adviser sign-off that cannot be edited afterwards
When you certify a fact find, Crestwell records your printed name, the date on the declaration and the moment it happened, as an append-only entry. Changing your signature next year does not change what you signed this year.
Prompts to complete, not boxes to tick
Crestwell drafts the Consumer Duty prompts and the vulnerability review from the meeting for you to complete. Health information is treated as special-category data throughout, and the pre-submission check blocks a pack that still contains a hospital letter or fit note before it reaches a lender.
An access trail on every client record
Every document view, download, generated PDF and shared recording link is logged against the client: who, what, when. The log records the event, never the contents, and it is part of the client's record for a subject access request.
A DSAR bundle in one action, and erasure that sticks
One action exports everything recorded about a client for a subject access response — fact finds, letters, notes, meeting transcripts, messages and the access and activity logs — with a list of their stored documents, each of which downloads from the client's file. If any part cannot be read, the export is refused rather than sent short. Erasure is written to a register that survives a database restore, so a client you deleted stays deleted.
Consent captured before the meeting is transcribed
Each recording stores when consent was confirmed. Audio is deleted once transcription completes, by default, so the recording exists for exactly as long as it is needed.
Six years by default, returned on request
If you leave, you choose: we return your data in a machine-readable format, delete it, or both. You have 30 days from termination to tell us, and we complete it within 30 days of your instruction. If you tell us nothing, we keep it for six years, so an Ombudsman complaint in year four does not land on a destroyed file.
The answers your due diligence will ask for.
- Legal entity
- Crestwell Technologies Ltd, registered in England & Wales, ICO registration ZC212034.
- Role under UK GDPR
- Data processor. Your firm is the controller; we process client data only on your documented instructions. Our Article 28 data processing agreement is available on request until it is published.
- Automated decisions
- None. Every AI output is a draft for an adviser to check, so nothing falls within Article 22.
- Breach notification
- We notify your firm without undue delay after becoming aware, with a clear statement of when we became aware, so your 72-hour ICO clock is yours to manage.
- Account security
- Two-factor authentication with backup codes, available to every account and enforceable for the whole firm by its owner. Owner, admin and member roles decide who can do what.
- Backups
- Daily automated backups, retained for seven days, in the same EU region as the live data.
- Your audit rights
- The DPA gives you the information needed to demonstrate Article 28 compliance, and the right to audit where that documentation is not enough.
Our sub-processor list and retention policy are published in full. The data processing agreement is available on request from privacy@crestwell.uk until it is published.
Found something? Tell us first.
Email hello@crestwell.uk with what you found and how to reproduce it. We acknowledge within two working days, keep you told while we fix it, and credit you if you want credit. We ask that you do not access, change or keep any client data beyond what proving the issue needs, and that you give us a reasonable time to fix it before you publish. There is no bounty programme. This address is also published at /.well-known/security.txt.
What your compliance officer will ask.
Is Crestwell FCA-authorised?
No, and it does not need to be. Crestwell is software: it never gives advice, never makes a decision about a client and never contacts a client with a recommendation. The advice, and the responsibility for it, stay with your firm and your advisers, which is what the FCA expects. What Crestwell does is make sure the record your firm has to keep exists by default.
Does having AI draft the file note or suitability letter cause a problem with the regulator?
The drafts are yours to check. Every field shows its evidence, you check each one, and nothing goes on the file until an adviser signs it off. The file the FCA or the Ombudsman would read is one an adviser reviewed and certified, with the sign-off recorded.
Where is client data held, and does it leave the UK?
Client records, documents and transcripts are stored in the EU (Ireland). AI drafting sends the content to Anthropic at generation time only, under UK transfer safeguards (the EU standard contractual clauses with the UK Addendum, in Anthropic's data processing agreement), and under commercial terms that prohibit using it to train models. The full list of who processes your data, and where, is on the sub-processors page of our legal documents.
What happens if there is a data breach?
We notify your firm without undue delay after becoming aware, say what we know and follow up as we learn more, and cooperate with your investigation. The decision to notify the ICO or affected clients remains with your firm as controller, and we make no notification or public statement on your behalf without your consent.
What if we stop using Crestwell?
You choose: we return your data in a machine-readable format, delete it, or both, within 30 days of your instruction. If you make no choice, we keep it for six years from termination and then delete it, because your record-keeping duty and Ombudsman exposure outlive the subscription. You can instruct deletion at any point in those six years.
Can we audit you?
Yes. The data processing agreement obliges us to provide the information you need to demonstrate Article 28 compliance, and gives you an audit right where that documentation is not enough.
Something we have not covered? Ask us directly, or read the full FAQ →