Trust & security
Sensitive files deserve a tool that passes a security review
Passports, bank statements and asylum evidence are among the most sensitive data an organisation holds. ScopeFlow is designed so you never have to send them anywhere.
Deployment you control
On-premise, air-gapped, or a dedicated single-tenant environment hosted in the EU. Models run locally; no document is ever sent to a third-party AI API.
GDPR by design
Data minimisation, configurable retention, encryption at rest and in transit, and a data-processing agreement for every deployment. ScopeFlow acts as processor; you remain controller.
Human oversight
ScopeFlow produces evidence and a recommended next step. It does not approve, refuse or score people. Every decision is made and recorded by an authorised officer.
EU AI Act readiness
AI that helps assess the reliability of evidence in visa, asylum and residence applications is classed as high-risk under the EU AI Act. ScopeFlow is designed around those duties: logging, technical documentation, transparency to users, accuracy testing and human oversight.
Tamper-evident logging
Each check, view, export and override is written to an append-only, hash-chained log that administrators cannot silently edit, a safeguard against insider abuse.
Tested, then published
Accuracy and false-alarm rates are measured on your own confirmed cases during the pilot and reported in writing. No headline accuracy claims without a test set behind them.
Security practices
What a deployment includes
Controls are configured with your security team during the pilot, and documented for your accreditation file.
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Role-based access with per-case permissions
- Single sign-on via SAML / OIDC
- Configurable retention and verifiable deletion
- Signed releases and software bill of materials (SBOM)
- Security review and penetration-test support for your accreditation process
Responsible use
Our commitments
- ScopeFlow never takes an automated decision about a person. Its output is evidence plus a suggested next step such as 'check the original' or 'invite for interview'.
- Signals are about documents and their consistency, never about nationality, ethnicity, religion or other protected characteristics.
- Every deployment includes a review of false alarms by group, so the tool does not quietly burden one population more than another.
- Customers must have a lawful basis for processing. We do not sell to uses aimed at mass surveillance.
Regulation
Where ScopeFlow sits under the EU AI Act
The EU AI Act lists AI systems that assist public authorities in examining asylum, visa and residence-permit applications, including the assessment of the reliability of evidence, as high-risk. Recital 60 explicitly carves verification of travel documents out of its exclusion for systems that identify people.
That classification is the reason ScopeFlow works the way it does: it produces evidence and a suggested next step rather than a decision, logs every action, keeps a human in charge, and is tested on your own cases before it goes live. Conformity for a specific deployment depends on how and where it is used, and we assess it together with your legal and data-protection teams.
Reference: EU AI Act, Recital 60 (European Commission AI Act Service Desk). This page is not legal advice.
Need our security questionnaire answers or a DPA template? Ask for the security pack.
Prove it on your own cases in 30 days
Pick one document type and one team. We deploy inside your network, test on files you already know are fraudulent, and hand you a written report.