Data & AI Handling

Honest, plain-English description of how ZARN processes your content during the pilot.

AI-assisted assessment

ZARN uses AI-assisted analysis to assess submitted content for protective security risks. Output is decision-support, not a formal threat assessment. Every finding requires human review before action.

How content is processed

Free-text scans: the text you submit is processed by ZARN's configured AI infrastructure for analysis.
Document scans: the uploaded document is text-extracted and processed by ZARN's configured AI infrastructure for analysis. The document file itself is deleted within 24 hours.
Website scans: public webpage content is retrieved using third-party infrastructure, then processed by ZARN's configured AI infrastructure for analysis.
Image scans: the uploaded image is processed by ZARN's configured AI infrastructure for visual analysis. Embedded metadata such as EXIF and GPS is extracted and stored as part of the scan record. The image file itself is deleted within 24 hours.

Retention of uploaded files

Uploaded images and documents are deleted automatically 24 hours after upload. The assessed text, extracted metadata and resulting findings are retained as part of the scan record, together with the file name, type and size, so that reports, evidence packs and returning-finding detection remain accurate. Webpage and free-text scans involve no uploaded file.

Subprocessors and third-party infrastructure

Scan content may be processed by configured AI infrastructure and subprocessors engaged by ZARN to deliver the service. A current list of subprocessors is available from your ZARN pilot point of contact.

Internal technical audit logs

ZARN maintains internal technical audit logs — including AI provider and model metadata — for security, quality assurance and troubleshooting. Customer-facing reports do not expose these low-level technical details.

SSRF protection on URL scans

Internal, private and unsafe network addresses are blocked. You may only scan public URLs you are authorised to assess.

Admin access is logged

If a ZARN super-admin needs to view a customer scan (for support, abuse review or quality investigation) they must provide a written reason. The reason and access event are written to an immutable access log before the content is shown.

Reports

Generated reports are AI-assisted. Review and validate before distributing internally or externally.

Your responsibilities

Only scan content you are authorised to assess.
Do not upload unlawful, unnecessary or excessively sensitive material.
Treat findings as decision support; apply human judgement before acting.

ZARN LTD is a private limited company registered in England and Wales under company number 16431762. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.