Security and governance

How we protect customer data, oversee Coach’s responses and support your institution’s review.

Data protection and GDPR

For each deployment, we document how personal data is used, the GDPR responsibilities of Narrative and the institution, and how requests to access or delete data are handled.

What Coach uses

Registration details (name, email address and business name); business bank-account transactions the owner connects through Open Banking with their explicit consent; accounting or commerce data where the owner connects a supported service; and the figures and context that come from using Coach. Coach never handles an owner’s banking login details.

Purpose

To provide the owner’s guidance. Data is not used for marketing, is not shared for third-party profiling and is not used to train AI models.

Responsibilities under the GDPR

Whether Narrative acts as a processor for the institution, or as a controller for particular processing, follows from how a deployment is set up. We assess this for each deployment and record the roles and the obligations that follow in the data processing agreement.

Connection permissions

The owner chooses which accounts and services to connect. Open Banking access lasts for a limited period, after which the owner renews it, and any connection can be removed at any time.

Retention and deletion

Data is kept while the owner uses the service. Owners can disconnect or ask for deletion at any time. Our standard policy is deletion from live systems within 30 days, and from backups within a further 30 days.

Rights requests

A named Data Protection and Privacy Lead coordinates requests to access, correct or delete personal data. Where we act for an institution, we pass requests on and help to answer them as the data processing agreement sets out.

Where data is stored

Production infrastructure runs on Microsoft Azure in the European Economic Area, and personal data is processed in the EEA. Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256, with keys held in Azure Key Vault.

Subprocessors

A small number, each under a data processing agreement: Microsoft Azure for hosting, databases, key management and AI model processing; a regulated account information service provider for Open Banking; and EU-hosted services for product analytics and AI quality evaluation. The current list is set out in the data processing agreement.

Personal details in conversations

Owners can write naturally. Passwords, access tokens, security codes and unnecessary identifiers are masked in logs and kept out of the business’s long-term memory, while useful business context is kept.

Records, policies and assessments

We keep GDPR records of processing and an asset register with named owners, under adopted data protection, data classification and data retention policies. We support your data protection impact assessment, and our privacy policy explains how we handle personal data.

This page describes Narrative Coach. Analytics on this website are separate and are described in our privacy policy.

Access and customer control

Customer sign-in

In an embedded deployment, customers sign in to your app as usual. Your backend issues a short-lived signed token for that customer, and Narrative verifies it before starting a session limited to your institution and that customer. In a standalone pilot, owners register with Narrative directly.

Separation between institutions

Sessions and data access are limited to the signed-in customer and their institution. Access across institutions is prevented by policy and by technical controls.

Narrative staff access

Role-based access on the principle of least privilege, reviewed every quarter, with audit logging. Staff work on managed devices with endpoint detection and response.

The owner controls sharing

When an owner asks to speak to you, they see what will be shared and choose before anything is sent. They can disconnect accounts or close their account at any time.

AI governance and human oversight

Coach helps owners understand their finances and prepare for decisions. It provides information and guidance, and your institution’s advice, assessment and approval processes continue to apply.

The EU AI Act

We assess each deployment against the EU AI Act, including the intended use, the responsibilities of Narrative and the institution, and the transparency and oversight measures required.

Intended use

Coach’s outputs are informational and are not used for eligibility, credit, pricing or other decisions with legal or similar effect. Coach mentions only products from the range you configure.

Human oversight

Automated checks run before responses are shown. Flagged outputs are withheld for review, and people review samples of Coach’s responses. Owners can ask to speak to your team; regulated advice and credit decisions remain with your institution.

Investment advice and MiFID II

Coach provides information and guidance. It does not make personal recommendations to buy or sell financial instruments or assess investment suitability. Where MiFID II applies, investment advice remains within the institution’s authorised process.

Evaluation before release

Every change to a prompt, model or processing step is evaluated against curated test sets before release, and a regression stops the release.

Monitoring in production

Outputs are scored continuously, with automated alerts and scheduled review of samples by people.

Transparency

Before they start, owners are told that Coach uses AI, that its outputs are guidance rather than financial, tax or legal advice, and what its limits are.

Clear about uncertainty

Coach keeps known figures separate from assumptions and projections, and says when data is missing or conflicting instead of filling the gap.

Audit, incidents and institutional review

Logs

Audit logging of access and activity, with records of responses, checks and requests sent to your team. Every request carries an identifier that support can trace.

Incidents

Incident management with defined severity levels, a 24-hour channel for critical and high-priority incidents and a review after every incident.

Security testing

Internal application security testing, dependency and container vulnerability scanning, and continuous automated monitoring of controls. An independent penetration test of the production applications by our security partner is in progress.

Reporting to you

Reporting on use and outcomes for your institution. For a pilot, the fields, aggregation and delivery of evaluation reporting are agreed with you.

Your due diligence

We have worked through supplier security assessments, data protection impact assessments, AI risk assessments and architecture reviews with financial institutions, and we provide a compliance and assurance pack for your review.

Audits and certifications

SOC 2 Type II
Audit in progressReport expected by the end of 2026.
ISO 27001
Certification in progressExpected by the end of 2026.

Central Bank of Ireland Innovation Sandbox Programme

Completed in 2026. Participation does not imply endorsement by the Central Bank of Ireland.

Authentication, token handling and the AI safety principles behind Coach are covered in our developer documentation.

Security documentation