We’re a brokerage. This is how we keep your data away from our broking.

Your people, and the agents you switch on. Access is by invitation only. Your admins choose who can sign in, how they sign in and what each person can see.

Nobody at Nationwide Energy’s broking business. No broker, account manager or sales person at Nationwide Energy has access to any brokerage’s data. That’s built into the database, not left to policy.

One named person, for support. Platform access is limited to one named person, through a separate login the app itself can’t use. Every access is recorded before it starts, with who, when and why.

Built: the separate login and the access record. Planned: asking your consent for each support session, and showing you the access record inside Tensio.

What our contract says. A data processing agreement makes us your processor: we act on your instructions only. The contract also says your data is never used for broking and your customers are never approached by us.

The contract and DPA are being drafted with our solicitor.

Separated in the database. Every brokerage’s records carry its own key, and the database itself refuses to return another brokerage’s rows (Postgres row-level security, forced on every table).

Tested on every change. An automated test tries to read and write every table across two brokerages, in both directions, and runs before any change can be merged.

Files kept apart too. Documents are stored in a private container for each brokerage. Downloads use links that expire after five minutes.

A dedicated database for a brokerage that wants one.

Email sign-in codes.

Microsoft and Google sign-in. Built, and switched on once the app registrations are in place.

Linking a Microsoft or Google account needs the person to be signed in already. An email address alone never links anything.

Agents act within limits you set. Each agent has a role, like a member of staff. For each kind of action you choose whether it runs on its own or waits for approval.

Agents show their evidence. A task the capture agent suggests quotes the words it came from. An AI field shows how confident it is, and why.

Emails can’t give agents orders. Text in an email is treated as information, never as an instruction. Tasks read from an email always wait for a person to approve them.

You can see and cap what AI costs. AI use is metered per brokerage, with a monthly limit.

Bring your own AI key if you want your own agreement with the AI provider. Built for Anthropic, OpenAI and OpenRouter.

Your data isn’t used to train AI models. Confirmed in our agreements with each AI provider before launch.

An audit trail. Every change is written to an event log in the same step as the change itself, so the record can’t miss one.

Every API and AI-app call is logged. Connected AI apps are read-only unless you allow more.

Export any list to a spreadsheet.

Export your whole book, files included, as a self-serve admin action. This has to exist before launch.

An API over all your records.

Microsoft Azure, UK South region. Production isn’t live yet.

Daily backups with point-in-time restore, and a restore tested before any customer data goes in.

Cyber Essentials.

An independent penetration test before the first customer’s data goes in.

ISO 27001 when a customer needs it.

Data processing agreement.

Sub-processor list.

Security overview and answers to a standard supplier questionnaire.