Your resident data stays in the UK

What UK data residency means in practice

AWS London (region code eu-west-2) is a set of data centres physically located in the United Kingdom, operated by Amazon Web Services. When Arto states that data never leaves the UK, this means that the servers on which data is processed and stored are in AWS's London region, within UK territory, subject to UK law and the jurisdiction of UK regulators.

Physical UK hosting matters for several reasons. It means UK GDPR's international transfer restrictions do not apply, as data never crosses a border that would trigger transfer safeguards. It means the ICO has full jurisdiction over any data processed through the platform. It means there is no exposure to foreign data access laws — such as the US Cloud Act — that can, in some architectures, give foreign governments or law enforcement access to data stored on overseas servers even when that data belongs to UK organisations.

The same AWS London infrastructure is used by a large number of UK public sector organisations, including NHS trusts, central government departments and local authorities. This is not an incidental choice — it reflects the infrastructure standard that UK public sector security assessments are built around.

In short:  UK data residency means the servers are in the UK, subject to UK law, within ICO jurisdiction. Data does not transit through non-UK infrastructure. UK GDPR transfer restrictions do not apply.

What ISO 27001 certification covers

ISO 27001 certification is issued by an accredited certification body following an independent audit of an organisation's information security management system. It is not self-certification. The audit covers 114 security controls across 14 domains, and recertification requires an annual surveillance audit and a full recertification audit every three years.

For an IT security team reviewing an AI platform, ISO 27001 certification means that security controls across access management, incident response, business continuity and data handling have been independently assessed against a recognised international standard. The certification does not eliminate risk, but it provides independent evidence that the organisation's approach to managing that risk meets an established benchmark.

ISO 27001 documentation is available to IT security teams during the formal security assessment process. If you are conducting a due diligence review of Arto and require the ISO 27001 certificate or ISMS documentation, contact the Arto team.

What happens to resident data after a workflow runs

When a workflow runs in Arto, resident data is processed to complete the specific task: a validation check, a triage analysis, a calculation. Once the workflow execution is complete, the data is not retained by Arto beyond what is required for the governance audit record. It is not stored in a pool of training data. It is not used to improve Arto's AI models. It is not shared with any third party for model improvement purposes.

The AI models that power Arto Supported Flows are not trained on council data. The models used in the platform are pre-trained on general or domain-specific datasets that do not include resident personal data. Council data flows through these models at execution time, informing the output of a specific workflow run, but it does not modify the model itself. This is the technical distinction between inference (using a model to process data) and training (using data to change a model). Arto uses models for inference only.

This position means that deploying Arto does not contribute to a shared training pool that could expose council data to third parties or cause it to surface in outputs generated for other customers. Each council's data is processed in isolation, for that council's purposes only, and is not used to benefit any other organisation's AI capability.

In short:  Resident data processed through Arto is used for the specific workflow task only. It is not retained for model training, not shared with third parties for AI improvement, and does not affect any model's behaviour for other customers.