Security and Transparency
We believe trust is earned through openness, not marketing.
If you are considering trusting Sales Triage with your data, you deserve a clear explanation of how we protect it, what is currently in place, and what we are improving next.
We would rather tell you honestly that something is not implemented yet than imply it exists because it sounds reassuring.
This area explains:
- how Sales Triage handles client information
- how the Revenue Engine is operated today
- what controls are already in place
- what improvements are planned
- which suppliers and subprocessors are involved
- how AI is used
- what questions other clients have asked
If you have a question that is not answered here, please ask. If it is useful for one client, we will aim to answer it here for everyone.
About Sales Triage
Sales Triage is operated by Tech Brand Limited trading as Sales Triage.
| Item | Detail |
|---|---|
| Legal entity | Tech Brand Limited trading as Sales Triage |
| Company number | 13495362 |
| ICO registration | ZC162861 |
| Registered address | Suite 525, 5 The High Street, Maidenhead, SL6 1JN, United Kingdom |
| Website | https://www.salestriage.co.uk |
| Privacy contact | paul@salestriage.co.uk |
What the Revenue Engine Does
Revenue Engine is an AI-assisted commercial execution platform.
It helps clients:
- build commercial strategy
- organise prospect and client information
- record activity and notes
- draft communications
- prepare follow-ups
- analyse opportunities
- create repeatable sales processes
- reduce administrative effort around suspecting, prospecting and client development
The aim is to create more time and space for salespeople to do the work that matters: real conversations, clear follow-up and better commercial judgement.
What the Revenue Engine Does Not Do
Revenue Engine does not:
- sell personal data
- operate an advertising network
- use client content to train AI models
- require special category data to operate
- require access to internal systems unless explicitly authorised
- monitor general browsing activity
- read a user's mailbox unless the user has explicitly connected an email integration for platform functionality
Where We Are Today
Revenue Engine is a young product, run by a small team, serving a small number of organisations. The architecture is deliberately simple, and we would rather you judge it on what is actually in place than on a stage label.
What is in place:
- UK hosting on a Fasthosts virtual server
- HTTPS enforced everywhere
- multi-factor authentication enforced for every user at sign-in, including administrators
- production access restricted to named individuals, under multi-factor authentication
- stored API credentials, integration secrets and mailbox/calendar tokens encrypted at rest (AES-256-GCM)
- weekly full backups and daily incremental backups, with offsite storage in UK-hosted Microsoft OneDrive
- a full restore from backup carried out and documented, re-tested at least annually
- a separate staging environment, with changes deployed there before production
- automated access-control and library vulnerability testing before every release
- a login and access audit trail, with alerting on tenant boundary violations and brute-force attempts
- a written incident response runbook
What is not, stated plainly rather than deferred to a stage we are growing out of:
- no independent penetration test has been completed. This is the most significant of these, and it is being arranged
- no full-database encryption at rest. Credentials and mailbox/calendar tokens are encrypted at the field level; the database volume itself is not yet
- the application and database run on the same virtual server. This is a resilience limitation rather than a confidentiality one, and separating them is planned
- no centralised intrusion detection. Our alerting is targeted at specific high-signal events rather than general anomaly detection
- no ISO 27001, SOC 2 or Cyber Essentials certification
Each of those is on the improvement plan with a position, not a promise. None of them is hidden, and we would rather you read this list before deciding than discover it afterwards.
Our Security Philosophy
Security should be proportionate to risk.
We focus on practical controls that reduce real risk, rather than making broad claims that cannot be evidenced.
Our approach is based on four principles.
Truth Before Marketing
We will describe what is true today, even where the answer is not yet perfect.
Evidence Before Claims
We will not claim certifications, controls or capabilities that are not in place.
Continuous Improvement
The platform will mature as usage, data volume and client requirements grow.
Clients Own Their Data
Clients remain responsible for the data they choose to store and use. Where Sales Triage processes that data, we do so to provide the service.
Key Pages
- Security Controls
- AI and Data Processing
- Suppliers and Subprocessors
- Government Requests
- Continuous Improvement
- Questions Clients Have Asked
- Changelog
- Privacy Policy
Contact
For security, privacy or supplier review questions, contact:
paul@salestriage.co.uk