Security and data
How StateMentor handles your data
Written for the people who have to assure this: information security, information management and data protection teams. If something you need is not here, ask and we will answer plainly.
Last reviewed 28 July 2026
Start with this
There is no operational data in the system
StateMentor is a training simulation. It is not a crime-recording system, a case-management system or an evidential statement system, and it must not be configured as one. Scenarios are fictional. Live case data, real victim or witness details and operational police information must never be entered, and our acceptable use policy prohibits it.
Every generated and exported document is watermarked as training material. The practical effect is that the platform sits outside your evidential chain and outside your operational risk register.
Hosted in the United Kingdom. All data is held in Amazon Web Services' London region.
Technical controls
What is built in, and how it is proven
Tenant isolation, fail-closed
Every organisation-owned record carries an organisation identifier, and all data access runs through a tenant-scoped model layer. An unscoped query throws rather than returning data. One force cannot read, write or even confirm the existence of another force's records. Proven by automated tests that run on every change, covering both the data layer and the routes.
Authorisation checked server-side
What a user can see in the interface is never what authorises an action. Every protected action is re-checked on the server against the user's role and organisation membership before it is carried out.
Immutable audit trail
Sensitive actions write an audit event recording who did what, when and to which record. Audit rows cannot be updated or deleted; attempts to do so throw. Coverage includes marking overrides, integrity decisions, membership and role changes, and administrative access.
Multi-factor authentication for privileged roles
Trainers, Supervisors and platform administrators must hold a second factor. Privileged areas cannot be reached without it, and a user is prompted to enrol the first time they try. Learners may opt in.
Marking that cannot be gamed by the model
Scores are computed from the marking dimensions in application code, never taken from the language model's own arithmetic, and a deterministic floor prevents a trivially short statement from scoring well whatever the model returns. A trainer can amend any score, with the before and after recorded.
Integrity signals, never automatic accusations
Paste, typing-burst, browser-focus and similarity signals raise a flag for a human to consider. The learner can explain. A trainer decides. Nothing is ever auto-failed and no one is ever labelled dishonest by the system.
Artificial intelligence
Where a model is used, and what it never receives
A large language model is used for four things: playing the fictional characters a learner questions, reviewing a draft when a learner asks for a check, producing a first-draft mark, and expanding a supervisor's brief into a draft scenario. It is held behind an application-owned interface with strict response schemas, so it cannot return free-form output into the product.
No personal data is sent to the AI provider
The request contains the marking rules, the fictional scenario material and the learner's own written text. No name, email address, account identifier or organisation identifier is transmitted. Usage is attributed to an organisation for allowance and cost purposes inside our own database only; those identifiers never form part of the request.
What the offence library is for
StateMentor does not determine charge, advise on charging or decide what an offence is. The library exists so a learner can see which elements their statement needs to cover, and so marking can flag where it doesn't cover them. Every finding is a prompt about the writing, not a conclusion about the case.
The offence library is not generated
Points to prove are written from the primary legislation published on legislation.gov.uk. Every entry names the statute or authority it derives from, so any entry can be checked at source, and entries can only be edited by a person. Where a scenario matches no entry, the learner is shown nothing rather than something invented.
The coach cannot leak the scenario
The writing coach receives only the briefing the learner has already seen, never the hidden scenario facts, so it cannot reveal information the learner has not yet discovered. It will not write statement content for the learner.
Marking is a first draft, not a decision
Trainers amend scores and findings with an audited reason, and control whether and when results are released. Competency decisions rest with a person.
Generated scenarios are reviewed before use
AI-assisted scenario authoring produces a draft. Nothing reaches learners without Supervisor review and publication.
Data handling
The questions you are going to ask
If you need any of this in your own template, send it over and we will complete it rather than asking you to work from this page.
The platform and its boundary
Is StateMentor an operational policing system?
No. It is a training simulation and must not be configured as a crime-recording, case-management or evidential statement system. All scenarios are fictional and every export is watermarked as training material.
What happens if someone enters real case data?
Our acceptable use policy prohibits it, and Supervisors are responsible for monitoring their organisation's use. Where operational data is reported to us or otherwise identified, we delete the content, notify the organisation's Supervisor and record it as an incident.
Who validates the legal content?
The offence library is written from the primary legislation published on legislation.gov.uk, and every entry names the statute or authority it derives from, so any entry can be checked at source. It is a training reference for what a statement should cover, not legal advice or a charging decision, and a trainer reviews every marking result.
Personal data
What personal data does the platform hold?
Account data (name, work email address, role, organisation and team membership), authentication data, and the training material a learner produces: their statements, drafts, notebook entries, scenario conversations and marking history. Nothing operational.
Do you process special category data?
No. Scenarios are fictional and operational data is prohibited, so no special category personal data should enter the platform.
Are you a controller or a processor?
For organisation accounts, the organisation is the controller of its users' training records and StateMentor is the processor, acting on the organisation's documented instructions under a data processing agreement. StateMentor is the controller of its own account administration and billing records.
What is sent to the AI provider?
The marking rules for the statement type, the fictional scenario material, and the text the learner has written. Nothing else. No account names, email addresses or identifiers are included in the request.
Is our content used to train AI models?
No. Under our provider agreement, content submitted through the API is not used to train models. The provider's data processing agreement is available on request.
Hosting, transmission and storage
Where is data hosted?
Amazon Web Services in the London region (eu-west-2). Processing and backups remain in the United Kingdom.
Who are the sub-processors?
Amazon Web Services (hosting, United Kingdom), Cloudflare (network and transport security), OpenAI (language model tasks, United States, under an international data transfer agreement) and Stripe (payment processing). A current list is available on request and we will notify customers before it changes.
Is data encrypted in transit and at rest?
Yes. All traffic is encrypted in transit via Cloudflare, and database storage and backups are encrypted at rest.
Where are exported files stored?
Exports are generated on request and downloaded by the user. They are not retained as a persistent store.
Access control
How is access separated between organisations?
Every organisation-owned record carries an organisation identifier and all access runs through a fail-closed tenant-scoped layer. An unscoped query throws rather than returning data. Automated tests prove that a user in one organisation cannot read, write or confirm the existence of another organisation's data.
How are accounts created and removed?
By Supervisor or Trainer invitation, or by CSV import. A Supervisor or Trainer can remove a member from their organisation at any time, and membership and role changes are audited.
Do you support single sign-on?
Not currently. SAML and OpenID Connect are not supported; accounts are created by invitation or CSV import. If SSO is a requirement for your organisation, tell us and we will discuss timing.
Is multi-factor authentication available?
Yes, and it is required for Trainers, Supervisors and platform administrators. Privileged areas cannot be accessed without it and users are prompted to enrol on first access. Learners may opt in.
Can your staff see our data?
Platform administration is limited to two named members of staff and all administrative access is audited. Support impersonation is read-only by default; elevated access requires a stated reason, is time-limited and fully audited.
Do you offer IP or email-domain restrictions?
Not in the current release.
Audit and monitoring
What is logged?
Sensitive actions write an immutable audit event recording actor, action, target record and timestamp. AI usage is recorded per organisation and task with model, token counts, latency and status.
Can audit records be altered or deleted?
No. Updates and deletions of audit rows are rejected by the application.
Will we be told about a personal data breach?
Yes. We will notify the organisation's nominated contact without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting their data. The notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed. We will cooperate fully with your own reporting obligations.
Retention, export and exit
How long is data retained?
Learner training records are retained for the life of the organisation's subscription. Account data is deleted 90 days after an account is closed. Audit events are retained for six years to preserve the integrity of the audit trail, and billing records for six years as required for UK accounting records. AI usage records are retained for 24 months and contact enquiries for 12 months. As controller, an organisation may instruct us to delete any of its records at any time.
Can we export our data?
Yes. Organisation reports, common findings and progress data export as CSV, and statements export as watermarked PDF.
What happens at the end of the contract?
The account moves to export-only access for 30 days, during which all reports, findings and statements can be downloaded. All customer data is permanently deleted from live systems within 90 days of termination, and expires from encrypted backups within 30 days as those backups rotate. A written confirmation of deletion is available on request. Audit and billing records are retained as set out above.
What are the backup and recovery arrangements?
Databases are backed up daily to encrypted storage in the London region and the most recent 30 days of backups are retained, so the recovery point is at most 24 hours. A full restoration rehearsal has not yet been carried out; one is scheduled before any force-wide deployment and we will not claim it until it has happened.
Assurance
Do you hold security certifications?
Yes. StateMentor holds Cyber Essentials Plus.
Has the platform been penetration tested?
Not yet. An independent test is scheduled before any force-wide deployment and we will share the summary and remediation status. We will not claim a test we have not completed.
Is a data protection impact assessment available?
As processor we do not carry out your DPIA, but we provide a DPIA support pack containing the data flows, data categories, sub-processor list, retention periods, security measures, international transfer mechanism and identified risks with mitigations, so your data protection officer can complete an assessment without going back and forth with us.
Do you offer a data processing agreement?
Yes, as standard, incorporating the processor terms required by Article 28 UK GDPR, and an international data transfer agreement covering language model processing in the United States.
Is the platform accessible?
Keyboard operation, screen-reader support and adjustable text are core requirements rather than later additions. A formal WCAG 2.2 AA audit of the core journeys has not yet been carried out; see our accessibility statement for the current position.
Does it integrate with our learning management system?
Not currently. There is no SCORM or LTI integration. Progress, findings and competency data export as CSV.
How do we report a vulnerability?
Email [email protected]. We aim to acknowledge within one working day.