Compliance Overview

1.  Our compliance commitment2.  Regulatory framework — full register3.  Policy register — all documents4.  Data protection and privacy compliance5.  KYC and AML compliance6.  Payment compliance and security standards7.  Consumer protection compliance8.  Modern slavery and human rights9.  Cybersecurity and information security10. Sub-processor and supply chain compliance11. Governance structure12. Risk management framework13. Compliance audit and review schedule14. Training and awareness15. Reporting concerns (whistleblowing)16. Regulatory registrations and memberships17. Changes to this overview18. Contact us

1. Our compliance commitment

Gradio Safety LTD is committed to conducting business with integrity, transparency, and full respect for applicable laws. We view compliance not as a burden but as a competitive advantage — clients trust us with their architecture and security because we hold ourselves to the highest standards.

2. Regulatory framework — full register

We operate under the following legal and regulatory frameworks. Each framework is mapped to the specific policy that governs our compliance with it.

3. Policy register — all documents

We maintain the following compliance policies. Each is reviewed at least annually and updated when laws or business practices change.

4. Data protection and privacy compliance

We comply with the UK GDPR, EU GDPR, and Data Protection Act 2018. Our data protection posture is defined in our Privacy Policy and includes:

• Lawful basis: We identify and document the Article 6 lawful basis for every processing activity (consent, contract, legitimate interests, legal obligation)
• Data minimisation: We collect only the personal data we need to deliver services and comply with legal obligations
• Data subject rights: We support all 9 GDPR rights (access, rectification, erasure, restriction, portability, objection, not to be subject to automated decision-making, withdrawal of consent, complaint to regulator)
• International transfers: We use UK IDTA, EU SCCs, and UK Addendum for transfers outside the UK/EEA. We conduct Schrems II Transfer Impact Assessments where required
• Data retention: We maintain a retention schedule with specific periods per data category (see Privacy Policy Section 9)
• Security measures: TLS 1.2+ in transit, AES-256 at rest, RBAC, MFA, WAF via Cloudflare (see Section 9 below)
• Breach notification: We notify the ICO within 72 hours of becoming aware of a notifiable personal data breach (Article 33 UK GDPR)
• Sub-processors: We maintain a sub-processor list with DPAs in place (see Section 10)
• Cookie consent: PECR-compliant cookie banner with granular consent and 12-month renewal (see Cookie Policy)

5. KYC and AML compliance

We comply with the Money Laundering Regulations 2017, Proceeds of Crime Act 2002, Terrorism Act 2000, and Sanctions and Anti-Money Laundering Act 2018. Our AML programme is defined in our KYC & AML Policy and includes:

• Risk-based approach: Every client is assigned a risk rating (low, medium, high) based on 6 risk factors (client type, geography, transaction value, payment method, service type, source of funds)
• CDD/EDD/SDD: Customer Due Diligence for all clients, Enhanced Due Diligence for high-risk clients, Simplified Due Diligence for low-risk clients
• PEP screening: All clients, directors, and UBOs are screened against PEP databases
• Sanctions screening: Real-time screening against 5 sanctions lists (UK HMT, UN, EU, OFAC SDN, OFAC Sectoral) — zero-tolerance policy on matches
• Transaction monitoring: Risk-based monitoring with red flag detection and structuring analysis
• SARs: Suspicious Activity Reports filed with the NCA via SAR Online portal; MLRO designated and trained
• Record keeping: 5-year retention of CDD records, transaction records, and SARs (Regulation 40 MLR 2017)
• Tipping-off prohibition: Staff trained on the criminal offence of tipping-off under Section 333A POCA
• Payment screening: Layered controls — our own screening plus payment gateway (OFAC, automated fraud detection, 3DS) and banking network screening

6. Payment compliance and security standards

We process payments through regulated payment gateways and banking institutions. We do not store card data or raw bank credentials on our servers — all payment transactions are handled directly on PCI-DSS Level 1 compliant infrastructure.

6.1 Card payment processing standards

6.2 Banking and electronic transfer standards

7. Consumer protection compliance

We comply with UK and EU consumer protection laws. Our Purchase Conditions and Refund Policy are designed to meet or exceed statutory requirements:

• UK Consumer Rights Act 2015: Services performed with reasonable care and skill; right to re-performance or price reduction
• EU Consumer Rights Directive 2011/83/EU: 14-day cancellation right for distance contracts; clear pre-contract information
• UK Consumer Contracts Regulations 2013: Pre-contract information, cancellation rights, no hidden charges
• Unfair Terms in Consumer Contract Regulations 1999: No unfair terms; plain language; transparency
• Business Protection from Unfair Trading Regulations 2008: No misleading actions or omissions in B2B dealings
• Alternative Dispute Resolution: We are registered with an ADR provider and signpost EU ODR platform

8. Modern slavery and human rights

Under Section 54 of the Modern Slavery Act 2015, we are committed to transparency in our operations and supply chain. We have a zero-tolerance approach to modern slavery, forced labour, child labour, and human trafficking.

• Our operations: We are a small UK-based company with no offshore operations, no manufacturing, and no physical supply chain. All our staff are UK-based professionals engaged under UK employment law.
• Our supply chain: Our sub-processors include Google, Cloudflare, Vercel, GitHub, and Notion — all reputable, publicly listed or established companies with their own modern slavery statements and ethical sourcing policies.
• Due diligence: We assess new sub-processors for modern slavery risk before onboarding. We review their modern slavery statements annually.
• Reporting: We publish a modern slavery statement on this page if we meet the turnover threshold (currently £36 million). As a small company, we are not legally required to publish a statement, but we voluntarily maintain these standards.
• Whistleblowing: Staff and partners can report modern slavery concerns through our Speak-Up channel (see Section 15) without fear of retaliation.

9. Cybersecurity and information security

We take a defence-in-depth approach to information security. Our security measures are designed to protect client data, our infrastructure, and our business operations.

9.1 Technical controls

9.2 Organisational controls

• Security training: All staff receive security awareness training on induction and annually
• NDA: All staff and contractors sign NDAs before accessing client data
• Incident response: Documented incident response plan with defined roles, escalation, and notification timelines (72-hour breach notification per Article 33 UK GDPR)
• Vendor security assessment: Sub-processors assessed for security certifications (SOC 2, ISO 27001, PCI DSS) before onboarding
• Access reviews: Quarterly access reviews to ensure only authorised personnel have access to client data
• Device security: All work devices have full-disk encryption, automatic updates, and endpoint protection

10. Sub-processor and supply chain compliance

We use the following sub-processors. Each is assessed for compliance, security, and data protection before onboarding. We maintain Data Processing Agreements (DPAs) with each sub-processor that processes personal data on our behalf.

For the full sub-processor list with processing locations and transfer mechanisms, see Section 7 of our Privacy Policy.

11. Governance structure

The Board reviews the annual compliance report, which includes: policy reviews completed, training completion rates, SARs filed, data subject requests received and resolved, incidents reported, sub-processor assessments, and any regulatory developments affecting the business.

12. Risk management framework

We maintain a risk register that identifies, assesses, and mitigates compliance risks. Risks are scored on likelihood (1–5) and impact (1–5), with a maximum score of 25. Risks scoring 15+ are classified as high and require Board-level attention.

13. Compliance audit and review schedule

14. Training and awareness

All staff and contractors receive compliance training appropriate to their role:

Training completion is recorded and retained for 5 years. Failure to complete training may result in disciplinary action.

15. Reporting concerns (whistleblowing)

We encourage all staff, contractors, clients, and partners to report any compliance concerns. We are committed to a culture of transparency and will protect those who raise concerns in good faith.

• What to report: Suspected money laundering, sanctions violations, data protection breaches, fraud, modern slavery, discrimination, health and safety risks, or any other legal or ethical concern
• How to report: Email info@gradiosafetyltd.com with "Confidential — Compliance Concern" in the subject line. For AML concerns, use "MLRO — Confidential".
• Anonymous reporting: You may report anonymously. We will investigate all reports regardless of whether you identify yourself.
• Non-retaliation: We do not tolerate retaliation against anyone who raises a concern in good faith. Retaliation is itself a disciplinary offence.
• Response time: We acknowledge all reports within 2 business days and provide a substantive response within 14 business days.
• External reporting: If you do not feel comfortable reporting internally, you may report to the relevant regulator directly (ICO for data protection, NCA for money laundering, police for criminal matters).

16. Regulatory registrations and memberships

17. Changes to this overview

We review this Compliance Overview at least annually and update it when there are changes to applicable laws, our policies, our sub-processors, or our governance structure. The "Last updated" date at the top of this page reflects the most recent review.

18. Contact us

For compliance questions, policy requests, audit enquiries, or to report a concern:

• General compliance: info@gradiosafetyltd.com
• MLRO (AML/confidential): info@gradiosafetyltd.com (subject: "MLRO — Confidential")
• DPO (data protection): info@gradiosafetyltd.com (subject: "DPO — Data Protection")
• Whistleblowing: info@gradiosafetyltd.com (subject: "Confidential — Compliance Concern")
• Company: Gradio Safety LTD, Company No. 17456330, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

For complaints about how we handle personal data, you may contact the ICO at ico.org.uk or 0303 123 1113. For AML concerns, the NCA can be contacted via the SAR Online portal at nationalcrimeagency.gov.uk.

v2.0  2026-08-28  Full rewrite — added full regulatory register, policy register, payment compliance tables, cybersecurity controls, sub-processor compliance, governance structure, risk management, audit schedule, training matrix, whistleblowing, registrationsv1.0  2026-08-27  Initial Compliance Overview