New: Document Integrations with Aconex and Procore are live. See what your AI can read now

Security and AI questions, answered.

Where your data goes, where it’s stored, how it’s processed and how the AI works. Everything your security review will ask, in one place.

We hold ISO 27001 and UK Cyber Essentials certification, and independent certified experts run penetration tests across the whole platform. Certificates are shared during formal information security reviews.

Nodes & Links runs on AWS, with logical tenant isolation enforced at the API and data layers. Data can be hosted in the USA, EU, UK or Australia by default, and other regions on request.

Yes. Host-level firewalls protect corporate endpoints, and network controls follow ISO 27001 guidance.

No. Confidentiality is governed by NDAs and strict authorisation. Data is segmented at the datastore level, and tenant identifiers are enforced at the API layer.

Databases, data stores and file systems are encrypted with AES-256. External transmissions use TLS with strong protocols and ciphers. Keys are managed and rotated through AWS.

Backups run daily, are encrypted like production, are replicated to a separate AWS region and are monitored continuously.

Role-based access control and least privilege, verified identity, unique accounts, annual access reviews and mandatory MFA for privileged accounts.

Security is built into every phase of development: threat modelling, code review, OWASP-aligned secure coding, segregated environments and independent testing outside production.

Two kinds. Machine learning predicts risk, using algorithms first developed for epidemic control, where accuracy and interpretability matter. Generative AI automates reporting, running on our own models.

It’s interpretable machine learning for high-stakes decisions, so professionals can check the reasoning. The approach is peer reviewed, published with MIT co-authors and validated on hundreds of live projects.

Independent testing on live projects showed 7x better accuracy than traditional forecasting and 2x more robustness against optimism bias. On milestone forecasts, the AI beat human predictions in 15 of 17 cases.

Each project gets its own prediction model. Once about 10% of activities are complete, activities are grouped by context, timing and connectivity, and weighted performance rates forecast the rest. The model retrains with every schedule update.

No. Each tenant is logically separated, and a project’s data trains only that project’s model.

It stays on Nodes & Links cloud infrastructure and isn’t shared with third-party providers. We run our own AI infrastructure on AWS, and may combine it with fine-tuned foundation models. Only schedule data is processed, never personal data.

Every time you upload a schedule. Retraining is automatic, with no manual step.

Encryption at rest and in transit, a web application firewall on every endpoint, ISO 27001 coverage of every AI capability, and annual third-party penetration tests that include the AI guardrails. Reports are available on request.

With backtesting and cross-fold validation: predictions made on historical data are compared with what actually happened.

Yes. Our ISO 27001 scope covers every AI capability, and annual penetration tests cover AI-specific concerns. Only schedule data is processed, with no demographic or personnel information.

None. It works from standard schedule uploads, with no integrations or data pipelines to build.

All of it. You decide whether to use, adopt or discard any AI feature or outcome, and admins can switch AI off for the workspace.

A 99.5% availability SLA over rolling 30-day periods, covering AI and non-AI features alike. Live uptime is on our status page.

Data can be stored in US, EU, UK or Australian regions.

Closed accounts have 90 days to download their data before it’s permanently removed. Accounts suspended for payment issues get a 30-day grace period, then the same 90-day cycle.

No. The platform can’t reproduce material from bodies such as AACE, PMI and APM. Get that material from the bodies themselves and follow their licences.