Access and company separation
Accounts use named users and controls that restrict access to the user’s company. Owner permissions govern billing, invitations, company exports, deletion and company-wide assistant access. Authentication controls include password protection, multi-factor authentication requirements where applicable, and session and request protections. Authorised staff support access is controlled and audited.
Files and transmission
The service uses HTTPS for protected transmission. Private files are accessed through authorised application routes rather than a public document library. Supported private-file storage includes encryption; this statement does not mean every stored record, downloaded copy or supplier record uses the same encryption scheme. Upload handling includes file validation, quarantine and security checks before eligible files are made available for use.
AI and customer control
AI receives information relevant to the requested feature and applicable permissions. The company owner controls Winston access to saved work and files and can revoke it. Review proposed changes and generated documents before approving or using them. AI permission does not make sensitive information suitable for unrestricted sharing; minimise personal data and respect buyer restrictions.
Operational safeguards
Security and audit records support investigation of access and service problems. Export expiry and cleanup reduce unnecessary copies. Backup and recovery arrangements, access restrictions and incident handling form part of the safeguards required by the Data Processing Addendum. Their effectiveness depends on continued operation and maintenance; no service can guarantee that an incident will never occur.
Your part and reporting concerns
Keep credentials and recovery codes secure, manage authorised users, secure downloaded exports, and do not upload passwords or classified information. Report suspected unauthorised access or a vulnerability to enquiries@crownpartners.co.uk. Provide enough detail to investigate without sending unnecessary sensitive data. Do not access other customers’ information or disrupt the service when reporting a concern.
Assurance and further information
This overview describes controls and their scope; it is not a certification, penetration-test report or guarantee of compliance with a particular procurement standard. Contact us for relevant security information for your assessment. The Data Processing Addendum sets out our contractual security, incident-notification and audit obligations.
Organisation details
Crown Technology Limited is a private limited company registered in England and Wales. Company number 17393089. Registered office: 9 Redwood Gardens, Thornton-Cleveleys, England, FY5 5NT. Email: enquiries@crownpartners.co.uk.