Trust & complianceCompliance is the architecture.
Not a feature.
Deterministic by design, independently certified or audited against six international standards and frameworks, and built to be explained to your board, your auditors, your regulator and your customers.
6
Certifications & attestations
3
ISO management systems for security, privacy and AI
0
Critical or high pen-test findings
Certifications & attestations
Independently certified. Continuously maintained.
Every certification is issued or audited by an independent body, and ISO certificates are subject to annual surveillance audits.
Security
Certified
ISO/IEC 27001:2022
Information security management system.
British Assessment Bureau · UKAS-accredited
Audited
SOC 2 Type II
Security controls, independently examined against the AICPA Trust Services Criteria for Security.
Prescient Assurance · unqualified opinion
Renewing
Cyber Essentials
UK government-backed protection against common cyber threats. Annual recertification in progress.
IASME scheme
Certified
Cyber Essentials Plus
Independent hands-on technical verification of controls.
IASME scheme
In progress
PCI DSS
Payment Card Industry Data Security Standard for card details captured in the call.
Assessment in progress
Privacy & AI
Certified
ISO/IEC 27701:2019
Privacy information management system, as controller and processor.
Prescient Security · IAS-accredited
Attested
GDPR
EU data protection, independently audited across 33 controls, all conforming.
Independent compliance audit
Certified
ISO/IEC 42001:2023
AI management system for responsible, governed use of AI.
Prescient Security · IAS-accredited
Industry membership
Member
Credit Services Association
UK trade association for the debt collection and debt purchase industry.
Supplier member · CSA directory
Independent assurance
Verified by accredited third parties.
Accredited audit partners
ISO certificates are issued by bodies accredited by the United Kingdom Accreditation Service (UKAS) or the International Accreditation Service (IAS). Cyber Essentials is certified under the IASME scheme.
Penetration tested
Independent testing of our web application in 2026 by a CREST-certified provider found no critical or high vulnerabilities, and every finding was fixed and retested.
Compliance map
A full compliance map with status, dates and certificates is maintained quarterly and shared with customers and partners under NDA.
By design
Why deterministic reduces risk.
Nothing can be said that has not been approved.
Governance takes place before the call, not after the complaint. Your compliance function signs off every word and every path, and every live response traces back to that approval.
No hallucination
Unapproved responses cannot be generated.
Fair treatment
The same standard for every customer.
Human oversight
Policy defines when a person takes over.
Full audit trail
Every step logged and reviewable.
Data protection
Your data. Your governance.
Encryption
TLS 1.2+ in transit and AES-256 at rest, including recordings and transcripts.
Access control
Least privilege, multi-factor authentication and full access logging.
Data processing & residency
Standard DPA, transparent subprocessor list, and UK and EEA client data stored and processed in the UK.
Resilience
Tested business continuity, disaster recovery and incident response plans.
Monitoring & testing
Real-time monitoring, penetration testing and continuous vulnerability assessment.
Data subject rights
Full support for access requests, erasure, portability and agreed retention.
Proof, not promises
Enterprise due diligence.
Ready when you are.
Ready when you are.
Certificates, audit reports, the compliance map and security questionnaires for procurement and risk teams. compliance@mega.ai