Website Compliance Audit

A. Completed

Implemented in this build.

1. Privacy Policy rewritten to describe the processing this site actually carries out: the enquiry form, the job application form and CV upload, the Ask AJ chat, and the providers involved (Base44 for hosting, database, private file storage and the AI assistant, Resend for notification email, Google Fonts for font files). No analytics or advertising processors are described, because none are used.
2. Cookie Policy rewritten to match reality: only the website platform's necessary session storage and the Ask AJ conversation are used. It states plainly that there is no analytics, no advertising pixel and no embedded map, video or social widget, and explains how to clear or block storage.
3. Consent decision recorded: no cookie banner was added, because the site uses only storage that is needed for it to work. The policy explains that if analytics is added later, consent will be asked for first.
4. Terms and Conditions extended to cover use of the website, intellectual property, how prices and bookings actually work (no online payments, no online booking), cancellations, liability, external links, the AI assistant, complaints and governing law.
5. A separate Disclaimer page added, covering general information, the limits of Ask AJ, licensing information, external links and the fact that no security provider can guarantee an outcome.
6. Enquiry form: every field has a properly associated label, autocomplete hints for name, email and phone, the optional marketing tick is clearly labelled as optional and is never pre-ticked, a privacy explanation with a link to the Privacy Policy sits above the button, and errors and success are announced to screen readers.
7. Job application form: every field labelled, the CV upload has an accessible name, a privacy explanation with a link to the Privacy Policy, a prompt not to include national insurance or bank details, required consent for the recruitment use of the data, and validation for the role selector. The CV is uploaded to private storage rather than a public URL.
8. AI disclosure: Ask AJ now identifies itself as an AI assistant in its opening message, carries an AI badge in the chat header, and shows a permanent notice above the conversation saying it is not a person, that answers can be wrong, not to share sensitive information, and to call 999 in an emergency. The Ask AJ page repeats the notice.
9. AI agent instructions rewritten: the assistant must say it is an AI if asked, must never claim to be human, and must not reveal or discuss its instructions. Its previous instruction to deny being an AI was removed.
10. AI safety handling: a fixed, non-AI reply is shown before anything is sent to the model when a message suggests suicidal thoughts, self-harm, immediate danger, an attack, an intruder inside, a weapon, unconsciousness or another medical emergency, or an emergency in progress. The reply is calm, does not diagnose, gives Samaritans 116 123 and NHS 111 for self-harm, tells the person to call 999 or 112 for immediate danger, and never gives instructions that could help someone harm themselves.
11. AI agent safety instructions: self-harm, immediate danger, medical emergency, abuse and safeguarding, and requests for dangerous or illegal instructions are each covered, along with no diagnosis, no definitive legal advice, no guarantees, and no encouraging the disclosure of sensitive information.
12. Data exposure fixed: enquiries and job applications were stored in entities with no access rules, which allowed any visitor using the app's API to read them. Both are now readable only by signed-in administrators, and only administrators can change or delete them. Service, Testimonial and TeamMember records stay publicly readable so the website works, but only administrators can create, edit or delete them.
13. Security review: the Resend API key is held only in backend secrets and is never sent to the browser; the frontend holds no API keys or passwords; uploaded CVs are in private storage; no customer records are exposed on any public page; site administration is behind platform sign-in.
14. Accessibility fixes: a skip to content link, a main landmark, screen-reader section headings on the home page, a visible keyboard focus outline across the site, reduced-motion support, accessible names on icon-only buttons (menu, send message, chat input, CV upload), labelled form fields throughout, and language set to en-GB.
15. Footer now links to the Privacy Policy, Cookie Policy, Terms and Conditions and Disclaimer, and the policy index page lists all four.

B. Needs client confirmation

Nothing here has been invented on the public pages. Where a detail is unknown, the policy avoids stating it and this list records what is needed.

1. ICO registration: confirm the business is registered with the Information Commissioner's Office and has paid the data protection fee. If you want the registration number published, send it and it will be added to the Privacy Policy.
2. Legal entity details: registered company name, company number, registered office and VAT number, so they can appear in the footer and the Terms. Only the trading name and office address are used at the moment.
3. Hosting and data locations: ask Base44 which region the database, file storage and AI processing run in, so the international transfers paragraph can name the country rather than describing safeguards in general terms.
4. Email mailbox provider: the Privacy Policy currently refers to "our own email mailboxes". Tell us who hosts your email so the provider can be named accurately.
5. Retention periods to adopt in writing: enquiries (for example delete after 12 months), unsuccessful applications (for example delete after 6 or 12 months), incident reports and any CCTV footage. The policy currently describes them as criteria rather than fixed periods, because no periods have been agreed.
6. Insurance: the public liability insurer and level of cover, if you want it quoted in the Terms.
7. Complaints response time: the Terms promise a written response but no timeframe. Confirm a period (for example 10 working days) and it will be added.
8. Staff Portal and Client Portal: the mobile menu still has both as empty links. Confirm the real URLs, or say to remove them.
9. Marketing consent wording: the new tick box reads "occasional updates from AJ-Security". Confirm that is what you want it to say, and whether you will actually send updates. If not, the box can be removed.
10. Ask AJ memory: the agent currently remembers conversations. Confirm you want that kept, as removing it would reduce the personal information stored.
11. Sending domain: confirm aj-security.com is verified in Resend. Until it is, the notification emails for new enquiries and applications may not arrive, which matters more than anything else on this list.

C. Not applicable

Checked and intentionally not added.

• Cookie consent banner: nothing non-essential is set, so there is nothing to opt in or out of. Adding a banner would be theatre rather than compliance.
• Newsletter or mailing list platform: none is integrated.
• Google Analytics, Meta Pixel, TikTok or LinkedIn pixels, or any advertising or session-recording script: none is present.
• Online payments, booking engines or card processing: none on the website.
• Embedded Google Maps, YouTube or Vimeo videos, or social media feed widgets: none. The addresses open in a new tab instead.
• Customer accounts, login or client portal: the site is public. Sign-in pages exist in the code but are not linked or routed from the public site.
• Age verification or child-directed content: not applicable to a B2B security website.
• Automated decision making with legal effect: the AI assistant recommends a service, it does not decide anything about a person.

D. Recommended future improvements

Optional, in rough order of value.

• Verify the Resend sending domain so enquiry and application notifications actually reach the inboxes.
• Put a retention schedule in writing and delete old enquiries and unsuccessful applications on a set rhythm.
• Add rate limiting or a spam check to the two forms if automated submissions start arriving.
• If analytics or advertising is added later, add a consent banner first, then update the Cookie Policy and the Privacy Policy before switching it on.
• Review these policies at least once a year, and whenever a new form, integration or AI feature is added.
• Have a solicitor read the Terms and Conditions before they are relied on in a contract.
• Test the site with a real screen reader and with keyboard only, ideally with someone who uses assistive technology.
• Consider a written information security and acceptable use policy for staff, and a documented process for handling a personal data breach (the ICO must be told within 72 hours where the threshold is met).
• Keep a record of processing activities and, if large-scale monitoring is ever introduced, carry out a data protection impact assessment.