AI Policy

Hove Capital Limited develops financial software for the fintech, personal finance, and banking sectors. We recognise both the substantial advantages that artificial intelligence can offer to software development and financial services, and the heightened need for care, control, and transparency where personal data, client systems, and regulated activities are involved.

This policy is the public counterpart to our internal AI Usage Policy, which sets the operational rules our staff and contractors follow. Where this policy gives an overview, the internal policy provides the detailed procedures. Both are reviewed at least annually, and sooner where our AI tooling materially changes.

This policy applies to all use of AI for Hove Capital work, on any Company device, in conjunction with any software or service we provide, or otherwise on our behalf. We use the term "AI" broadly. It covers:

• Third-party hosted AI services such as commercial chat assistants and APIs
• Self-hosted AI software, including locally run open-weight models
• AI hardware operated by or for the Company
• Any retrieval, agentic, or tooling layer built around such AI, including Model Context Protocol (MCP) servers

Genuinely personal AI use, unconnected with Company work and involving no Company data, falls outside the scope of this policy.

The following principles guide every decision we take about AI:

• Responsibility: We are accountable for the AI we use and for the outputs we accept and apply. AI is a tool, not an authority.
• Lawfulness: Our AI use complies with applicable law, including data protection law, intellectual property law, and any sector-specific obligations we or our clients are subject to.
• Confidentiality: We use AI in a way that protects confidential and personal information, both our own and that of our clients and Data Subjects. Where material is sensitive, we run the model on hardware we own rather than send the data to a service operated by someone else.
• Proportionality: We select and deploy AI proportionately to the task, with the minimum necessary data exposure for the result required.
• Verification: AI outputs, including code, text, and decisions, are reviewed by a human before being relied upon, deployed, or shared externally.
• Transparency: We are open with our clients and Data Subjects about our use of AI, including disclosing AI involvement in deliverables where appropriate.
• Continuous review: The AI landscape changes rapidly. We expect our approved tooling to evolve and treat every change as a controlled change.

We maintain an internal AI Tools Register that lists, at any given time, the AI tools, services, models, and hardware approved for Company use, together with the approved purposes, restrictions, deployment model, and any cross-border or data-sensitivity flags.

Tools and configurations not on the Register are not used for Company work. New entries and material changes to existing entries are approved by the Managing Director, and additionally assessed by the Data Protection Officer where personal data is involved. The Register is reviewed at every quarterly access review and any time a new AI tool, model, or significant hardware change is introduced.

Different ways of running AI carry different risk and compliance characteristics. Our starting position is that any AI service we do not own is untrusted, however reputable its operator: data sent to it leaves our control. Sensitive material is therefore processed on hardware we own and manage, and is kept away from third-party services. Each entry in our Register is mapped to one of the following deployment models, and the constraints below apply:

• Local Company-managed AI hardware: Hardware we own and operate at a staff working location, running open-weight models. This is our preferred destination for sensitive work. We control the machine, its storage, and the network it sits on, so nothing processed on it is disclosed to any third party, and no model provider receives or trains on the data. Inputs, outputs, and cached data remain on Company-managed infrastructure. Personal data is processed here only where we have a lawful basis and the Data Protection Officer has assessed and recorded the use, as with the recordings covered by our Call Recording Notice.
• Local on-device inference: Lightweight models run directly on a Company device, used for assistive tasks such as autocomplete or summarisation. Inputs do not leave the device. Models are loaded only from reputable, attributable sources.
• Commercial cloud AI APIs: Third-party hosted AI services accessed over the internet, such as those operated by Anthropic and OpenAI. We recognise that frontier models represent the most capable LLM and agentic technology available, and that there is genuine client benefit in using them, so we do not rule them out. We do treat them as untrusted: data sent to them leaves our control, so we control what is sent rather than rely on the provider to protect it. They are used only under business-tier or higher terms of service that prohibit training on Company input. Where client material is used with them, it is first passed through automated personal data and customer data scrubbing, which removes or replaces names, contact details, account and transaction identifiers, and other identifying values, and the result is checked by a person before it is submitted. Raw client production data and unscrubbed personal data are never sent. Cross-border data transfers are assessed under our Data Protection Policy.
• Rented GPU compute: Open-weight or proprietary models run on rented infrastructure where we control the workload but not the underlying hardware. Treated as untrusted for the same reason. No personal data, no client confidential information, no client production data, and no Company secrets are processed on rented compute without prior assessment by our Data Protection Officer.
• Custom AI tooling and MCP servers: Internal tooling that connects an AI to data sources. Read-only access to non-production, anonymised, development-only data by default. Production data, production credentials, and personal data of any real Data Subject are not reachable through any such tooling without prior written approval and a Data Protection Impact Assessment.

We classify data and apply corresponding rules on AI use. The summary below sets out what we permit, and what we never permit, at each tier:

• Public: Public documentation, our published policies, and public open-source code. Permitted with any approved tool.
• Internal (non-sensitive): Internal documents that do not contain personal data, client confidential information, or Company secrets, and non-sensitive code. Permitted with any approved tool.
• Confidential: Client business information not in the public domain, non-public commercial information, and non-personal-data analytics. Processed on local Company-managed AI hardware or by local on-device inference by default, where the data stays under our control. Where a frontier cloud model is the right tool for the work, the material is scrubbed of personal and customer-identifying data first, as described under Deployment Models, and submitted under business-tier terms that prohibit training on our input. Not processed on rented GPU compute.
• Personal data: Any data identifying a Data Subject. Processed only on local Company-managed AI hardware or by local on-device inference, and only where we have a lawful basis under our Data Protection Policy and the Data Protection Officer has assessed and recorded the use. It is not sent to commercial cloud AI APIs or to rented GPU compute: where client material is prepared for use with a cloud model, the identifying data is removed by our scrubbing process first, so what leaves our infrastructure is the scrubbed material and not the personal data. A Data Protection Impact Assessment is carried out where processing is likely to result in a high risk to Data Subjects.
• Production secrets and credentials: API keys, deployment keys, database credentials, environment files, certificate private keys, and OAuth tokens. Never submitted to any AI tool under any circumstances. Any inadvertent submission triggers immediate rotation of the affected secret and incident handling.
• Client production data: Live customer records, transaction data, and end-user content held in client production systems where we act as Data Processor. Never sent in raw form to a commercial cloud AI API, to rented GPU compute, or to any other third-party AI service. Processed with AI only on local Company-managed hardware, and then only under explicit written instruction from the relevant client, supported by an appropriate Data Processing Agreement that authorises that use. Scrubbed extracts derived from it may be used with a frontier cloud model on the terms set out for Confidential material above.

Where this policy refers to "anonymised" data, we mean data processed such that no living individual can be identified, directly or indirectly, by reasonably likely means. Pseudonymised data, where re-identification remains possible by reference to a key or to other data, is not anonymised and continues to be treated as personal data.

Our scrubbing process is held to that same anonymised standard. Material is submitted to a third-party AI service only where the scrubbed version does not allow a living individual to be identified by reasonably likely means. Where scrubbing cannot achieve that, for example because the material is only meaningful with its identifiers intact, the work is done on local Company-managed hardware instead.

AI-assisted code, documents, analyses, and other outputs are reviewed by a human before they are deployed, distributed, or relied upon. Information obtained directly from AI must have its authenticity and accuracy checked before it can be used in any deliverable. This covers:

• Generated code and code suggestions
• Technical documentation and specifications
• Research outputs and data analysis
• Security recommendations
• Regulatory or compliance guidance

Where AI is used to support a decision that has legal or similarly significant effects on a Data Subject, that decision is not based solely on the AI output, and the affected Data Subject's rights under Article 22 of the UK GDPR are respected.

Where AI is used to verify earlier work, for example an AI review of human or AI-generated code, the verification result is itself confirmed by a human before being acted on. Where AI assists with research or synthesis, cited or referenced facts are checked against authoritative sources before being relied upon in client-facing or regulator-facing work.

Outputs of AI tools may reflect biases or inaccuracies present in their training data. We treat this as a real risk and check outputs against reliable, up-to-date sources before further use.

Where AI is used in connection with regulated activities or financial decision support, we apply additional care to test for bias and to document mitigation steps. Where we identify a bias or inaccuracy that has already affected a client deliverable, we report it to our management, correct it, and inform the affected client where appropriate.

Where the relevant AI tool's terms permit, we own the intellectual property in outputs produced by our staff in the course of Company work. Where a tool's terms require attribution, we apply that attribution.

We remain alert to the risk that AI outputs may incorporate third-party intellectual property from training data without attribution. Where there is reasonable doubt as to the licensability of an output, the output is reworked or discarded.

Source code containing material commercial value, trade secrets, or third-party-licensed components subject to use restrictions is not submitted to AI tools other than those whose terms have been specifically assessed for that purpose.

Where AI has been used in producing a deliverable, we are transparent with the client about that use. Where AI is used in connection with personal data, the affected Data Subjects are informed in accordance with our Data Protection Policy and the relevant privacy notice.

We apply the following security measures to our AI use:

• AI tools accessed via the internet are authenticated using our standard access controls, including multi-factor authentication where supported.
• Local Company-managed AI hardware is physically secured at the staff working location and recorded in our asset register.
• Network access to local Company-managed AI hardware is limited and is not exposed to the public internet without prior approval from our management.
• Data held on local AI hardware, including cached inputs and outputs, stays on that hardware. It is not synchronised, backed up, or otherwise copied to any third-party service.
• Client production data is present on local AI hardware only where the relevant client has instructed that processing in writing, and personal data only where the Data Protection Officer has assessed and recorded the use, as with the material covered by our Call Recording Notice.
• Custom MCP servers and similar tooling apply least-privilege access in line with our Access Control Policy and log access for review.

Hove Capital is committed to working in line with established standards for the responsible use of artificial intelligence, including the principles laid out in the BS EN ISO 42001 International Standard for Artificial Intelligence Management Systems.

We comply with all applicable legal and regulatory obligations concerning AI and data protection, including the guidance of the Information Commissioner's Office (ICO).

We review this policy and our underlying AI practices at least annually, and sooner where required. A review is also triggered by:

• Material changes to our AI Tools Register
• Any incident involving AI
• Significant developments in AI technology or in related regulation
• New AI tools or fresh use cases being proposed

Should you have any questions about this AI Policy or about the way we use artificial intelligence, please get in touch:

• Email: [email protected]
• Data Protection Officer: [email protected]
• Telephone: 01273 937117
• Address: Curtis House, 34 Third Avenue, Hove, BN3 2PD

Hove Capital Limited is registered in England under company number 13049782.