The ExpertBridge platform, its database and all uploaded files are hosted on Amazon Web Services in Mumbai, India (ap-south-1). Client requirements, engagement records, messages and deliverables are stored there and are not replicated to other regions.

A small number of service providers process specific data outside India — video sessions, email delivery and message notifications. Each is listed below.

India is not the subject of an adequacy decision by the European Commission or the UK Government.

Where we receive personal data from the UK or the EEA, we rely on the European Commission's Standard Contractual Clauses, and on the UK International Data Transfer Addendum where the UK GDPR applies, together with supplementary measures: encryption in transit and at rest, role-based access control, and the identity-protection measures described below.

We will provide a copy of the transfer mechanism we rely on on request.

We will tell customers before adding or replacing a sub-processor that handles their data.

Our electronic signature system is operated by us on our own infrastructure. Signed agreements are stored in our AWS account in India and are not sent to a third-party signature service.

We use AI in two places: an assessment of experts, and a tool that drafts an engagement brief from a one-line description.

Both run on the Microsoft Azure OpenAI Service. Microsoft acts as our processor under contract. Customer data is not used to train or improve any AI model, and is not shared with OpenAI. Microsoft's terms for the service prohibit both.

The expert assessment produces a decision about whether an expert is listed. Experts have the right to human review of that decision, and every expert proposed to a client is reviewed by a member of our team before the proposal is made.

A DPA incorporating the Standard Contractual Clauses and the UK Addendum is available on request from privacy@expertbridge.co. We can execute your DPA or supply ours.

Confidentiality is a structural property of the platform, not a policy applied on top of it.

• Clients are not identified to experts. An expert sees a first name. They do not see your organisation's name unless you choose to tell them.
• Experts are not identified publicly. Experts appear under an anonymised identifier. Profiles are not visible to anyone who is not signed in and are not indexed by search engines.
• Registration requires a corporate email address. Free webmail addresses are not accepted for client accounts.
• Every expert signs a written agreement before any engagement, containing confidentiality obligations that survive termination, an express prohibition on using client information to train any AI system, and a warranty that participation does not breach any obligation to a current or former employer.
• Work product belongs to you. All deliverables, code, documents and analyses created during an engagement vest in the client on creation.

• Encryption in transit (TLS) and at rest
• Role-based access control; production access restricted to named personnel
• Multi-factor authentication on administrative access
• Access to production systems logged
• Passwords stored only as salted hashes, not readable by us
• Nightly database backups, taken and verification-tested
• A separate staging environment for testing, containing no live customer data

If a breach occurs that is likely to result in a risk to individuals, we notify the relevant supervisory authority within the period the law requires and inform affected customers without undue delay.

We comply with India's Digital Personal Data Protection Act 2023, and with the EU and UK GDPR in respect of data subjects in those regions. We do not sell personal data, do not use it for advertising or profiling, and run no analytics or advertising cookies.