Hush AI

Procurement & due diligence

Everything a practice manager, DPO, or procurement lead needs to assess us, including the things we have not got yet. We would rather you read an honest "in progress" here than discover an overclaim later. If your technical reviewer wants to test our claims directly, send them to the verify-us page.

The jurisdiction question, answered. One of the seven questions below is which jurisdiction could compel disclosure of your data. Here is why it matters: in June 2025, Microsoft France's director of public and legal affairs was asked at a French Senate hearing, under oath, whether he could guarantee that data held for French citizens would never be passed to US authorities. His answer: "No, I cannot guarantee it." Under the US CLOUD Act a US-owned provider can be compelled regardless of where the data is stored. Microsoft says it has never happened; the point is they could not promise it would not. Hush runs on hardware we own, with no US parent and no third-party AI in the chain, so that question does not arise here. Read what was said.

Certification status, dated and honest

Item	Status	Detail
GDPR documentation pack	Held	Data Processing Agreement, DPIA template, data-flow diagram, retention & deletion policy, incident response plan. All available on request before any pilot.
ICO registration	Held	Registered as a data controller, registration number ZC126901.
Cyber Essentials	In progress	Application in preparation via IASME. This page will state the certificate number and date the day it is issued.
Cyber insurance	In progress	Quotes under way with UK specialist insurers.
NHS DSPT	In progress	Self-assessment under way, not yet published. Pilots run under your organisation's own DPIA, we supply a pre-filled template your organisation adopts and owns.
DTAC	Not held	Deliberately deferred: practice-level purchases do not require DTAC. We will pursue it when trust-level deployments justify it, and say so here.
Medical device registration	Not applicable	Hush is not a medical device and not an ambient scribe, it drafts documents under clinician review. This boundary is deliberate and documented.
Uptime SLA	Not offered	We do not sell an SLA we cannot yet evidence with public monitoring history. Plans are monthly, cancel anytime, with full data export within 24 hours.

Last reviewed: 11 June 2026. If anything on this page is out of date, tell us at [email protected] and we will correct it within one working day.

What you can have before signing anything

The legal pack, DPA, DPIA template, data-flow diagram, retention policy, incident response plan. Email [email protected].
A free two-week written pilot, no card, no calls, up to 5 logins, under your own DPIA.
Your own audit trail, one-click export (CSV or JSON) of every request your organisation has made: timestamps and metadata, never content. Your IG evidence, yours to keep, during and after any pilot.
The database schema, open for inspection during a pilot, so your IG lead can verify our retention claims against the actual tables.

We are an early-stage company, so if your process asks for reference sites we will be straight: you would be among our first. Rather than another organisation's numbers, the free pilot above leaves you your own evidence, verifiable against the company at Companies House (17278687) and the ICO (ZC126901), with the database schema open for your IG lead to inspect. Every supplier had a first customer, and we would rather earn yours on your own data than borrow a testimonial you cannot audit.

Seven questions to ask any AI supplier, including us.

Who owns the company, and in which jurisdiction could a court compel data disclosure?
Who owns the hardware your data is processed on?
Is prompt or response content stored? Where, for how long, and who can delete it?
Is customer data ever used to train models?
Which sub-processors touch personal data? Ask for the full list.
Can you export a complete audit trail of your organisation's usage, without asking permission?
What happens to your data, including backups, when you leave?

Our answers are on the Security page, in writing, with the uncomfortable parts included.

How buying works

No procurement framework is needed for practice-level purchases. Plans are monthly with no lock-in: pilot free for two weeks, then pay by card through Stripe. Larger organisations can request a custom DPA and invoicing at [email protected]. Every commitment we make is in writing, on this site, dated.