Security and governance
Built for regulated firms, from day one.
Your client data stays yours. Scrutti processes it to run your checks, under a data processing agreement, and nothing else.
Access
Firm isolation
Each firm's data is kept separate. Users can only ever see their own firm's cases, and advisers see only the cases assigned to them.
Adviser privacy
Advisers see their own feedback and actions; firm-wide oversight is for owners and compliance roles.
Roles and 2FA
Role-based access for owners, compliance, sales, advisers and read-only users, with mandatory two-factor authentication for everyone.
Accountability
Human sign-off
Every check is confirmed or changed by a named person in your firm before it is final.
Full audit trail
Logins, checks, reviews, role changes and remedial actions are recorded in an append-only audit log.
Versioned rulebooks
Every rulebook version is kept with its change log, so you can show exactly which standard a case was checked against.
Data
UK GDPR
We process client data only to run your checks, under a data processing agreement.
Client files deleted after sign-off
Client files you upload are deleted within 2 days of a check being signed off, and never kept more than 10 days. You are told when they have gone. Scrutti is not a record-keeping system: keep your originals in your own systems. File review sheets, MI and reports are kept.
Never used to train AI
Your client data is never used to train AI models.