Security · privacy · assurance
Controlled operational AI needs a credible security model.
SIRV applies a structured, risk-based approach to information security and privacy, informed by ISO/IEC 27001:2022 principles and designed for operational environments where evidence, access, review and accountability matter.
Important: SIRV is not presented here as ISO/IEC 27001 certified. This page explains our alignment approach and the areas a buyer can examine during security, procurement and assurance review.
What alignment means
Alignment is a way of working, not a certification claim.
ISO/IEC 27001 provides requirements for establishing, implementing, maintaining and continually improving an information security management system. For SIRV, the useful principle is disciplined, risk-based management of information security over time.
| Buyer question | SIRV approach | What this page claims |
|---|---|---|
| Is SIRV ISO/IEC 27001 certified? | No certification claim is made on this page. | Our security approach is informed by ISO/IEC 27001 principles. |
| How is information security treated? | As an ongoing governance and operational responsibility, not a one-off technical feature. | Security thinking includes risk, process, accountability, access and review. |
| Can buyers examine the security posture? | Relevant detail can be discussed in the appropriate procurement or assurance process. | Specific security posture and control information is provided in context. |
Operational controls
Security and privacy sit inside the workflow.
The same controls that make operational AI more reviewable also make its information handling easier to assess. The design objective is not autonomous decision-making. It is controlled support around approved information, defined roles and visible human judgement.
| Control area | Operational design intent | Why it matters |
|---|---|---|
| Approved information | Workflows are shaped around the sources and records relevant to the task. | Reduces reliance on open-ended or unexplained information sources. |
| Access and roles | Information and workflow use should reflect role-appropriate access and organisational expectations. | Supports proportional handling of operational information. |
| Traceability | Outputs are designed to retain clearer links to the material, workflow and actions involved. | Helps review what informed an output and what happened next. |
| Human review | Consequential findings remain subject to appropriate human verification, approval or escalation. | Keeps accountability with the designated person or team. |
| Records and oversight | Operational records support review, handover, follow-up and organisational learning. | Creates a more defensible history than isolated AI responses. |
Buyer review
A clearer route through procurement and assurance.
Security review is easier when the workflow, information sources, responsibilities and review points are explicit from the start.
Define the workflow
Agree the operational task, intended outputs and consequences of error.
Identify information
Establish the procedures, records, documents or other approved sources involved.
Set access
Clarify who can use the workflow, review outputs and handle relevant information.
Set review points
Make human verification, escalation and approval explicit where consequences require it.
Review assurance
Provide the relevant security and control detail for buyer, procurement or assurance scrutiny.
What matters in consequential work
Protect the information without losing operational accountability.
Information security
A credible security model needs to consider confidentiality, integrity and availability alongside governance, people, process and technology.
- Structured treatment of information security risk
- Careful handling of customer and operational data
- Role-appropriate access and review
- Records that support oversight and auditability
Operational governance
For safety, security and resilience teams, security controls are only part of the picture. The workflow also needs to show where evidence comes from, where judgement sits and who remains accountable.
- Approved sources rather than unexplained answers
- Defined workflow boundaries
- Human verification for consequential findings
- Clear ownership of decisions and follow-up
A general-purpose AI tool can produce a useful answer. SIRV AI is designed around the wider operational workflow needed to make that support more controlled, reviewable and accountable.
Frequently asked questions
Questions procurement and security teams commonly ask.
Is SIRV ISO/IEC 27001 certified?
No certification claim is made here. SIRV describes its security approach as informed by ISO/IEC 27001 principles.
Which version of the standard is relevant?
The current published standard is ISO/IEC 27001:2022. It sets requirements for information security management systems and uses a risk-based approach to information security.
Why is ISO/IEC 27001 relevant to operational AI?
Operational AI can sit close to procedures, incident material, documents and other information that requires careful handling. A structured security-management approach helps buyers examine governance, access, accountability and review alongside the technology.
Does this page list every SIRV technical security control?
No. It explains the approach and the areas relevant to buyer review. More specific security posture and control information can be discussed in the appropriate procurement or assurance context.
How does this connect to SIRV AI's wider operating model?
The same principles recur across the product: approved information, defined workflows, traceability, human review and clear operational accountability.
Security review
Assess the workflow and the control model together.
If you are evaluating SIRV AI for a consequential operational workflow, we can discuss the security, privacy and assurance requirements alongside the operational use case.
