Security and data protection
Security, access and data handling
LETO handles personal data about tenants, landlords and staff. This page explains access controls, limits on automated actions and which arrangements we confirm with your agency.
Send us your security questionnaire and we will complete it in writing.
Principles
How we handle your data
These are the principles LETO is built to, covering both your data and what the automation is allowed to do. We will answer questions on any of them in writing.
Access by role
People should see what their job requires and no more. Branch and group roles are part of the design rather than an afterthought.
Least data held
We would rather hold less. If a field is not needed to do the work, there is no good reason to collect or keep it.
A readable trail
Changes to records should be attributable, so that answering “who changed this and when” does not require a support ticket.
Your data remains yours
Export should be possible without negotiation. Software that is difficult to leave is a commercial tactic, not a feature.
Consent in your own tenant
Where a connection touches your Microsoft 365 or CRM environment, your own administrator grants it. We do not assume access.
Written change
Anything that affects how your data is processed is set out in writing before it happens, so nothing changes under you without notice.
Automation you can bound
Your administrators decide which steps LETO may take without a person, by branch and by role. Anything outside those limits waits for someone to approve it.
Automated decisions are explainable
Where LETO evaluates something and acts, the action and the reasoning behind it are written onto the case, so a decision can be reviewed and corrected rather than taken on trust.
Current position
Published information and agreement-specific details
The lists below distinguish published information from arrangements confirmed during due diligence. Ask us for the details your agency needs before connecting records.
What we can state today
Access is designed around roles, so colleagues see the records their work requires.
Connections to your Microsoft 365 or CRM environment require consent granted by your own administrator.
Your licensing and contractual arrangements with third-party providers continue to apply, unchanged by us.
We will answer a security questionnaire directly, in writing.
Any change affecting how your data is processed is set out in writing before it takes effect.
Automated steps run only within the limits your administrators set, and each one is recorded against the case with its reasoning.
What we confirm with you directly
Certification and accreditation questions are answered in your security questionnaire, with evidence where it applies.
Audit and assurance documentation is covered during due diligence rather than published on a public page.
Service levels are set out in your agreement, sized to your operation.
Hosting region and data residency are confirmed for your agency during onboarding.
Sub-processor list, retention periods and deletion timescales are provided on request.
Backup and recovery timings are agreed alongside your own continuity requirements.
Our model-training position, and any third party involved in automated evaluation, is set out in your agreement.
Due diligence
Questions you should put to us
Ask us any of these and you will get a direct written answer.
Are you certified to any security standard?
Send us your security questionnaire. We’ll confirm our current certification status in writing and provide supporting evidence where applicable.
Where will our data be held?
Who at LETO can see our records?
Can we get our data out if we leave?
What happens if there is a breach?
Who you are contracting with
Operator, controller and where to send requests
LETO is operated by AIC Professional Services UK Ltd. Security questionnaires, data protection requests and vulnerability reports all reach the same company, so you are not chasing a separate entity.
Contracting entity
AIC Professional Services UK Ltd, company number 12252641, incorporated in England and Wales on 9 October 2019. Registered office: 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF. VAT number GB347679743.
Data protection registration
Registered with the Information Commissioner’s Office under reference ZC009289, registered 8 October 2025 at Tier 1 and renewable on 7 October 2026. Processing is carried out under the UK GDPR and the Data Protection Act 2018.
Where to send things
Security questionnaires and product questions: hello@leto.ai. Data protection requests, complaints and vulnerability reports: privacy@aicuk.ltd. Legal notices: contact@aicuk.ltd or the registered office above.
Where a data processing agreement is required, it is agreed in writing. Do not send tenant files, classified material or special category data through a web form before we have agreed a suitable channel.
Send us your security questionnaire
Include your questions about access, automated actions, hosting, retention and sub-processors. We’ll respond in writing and identify any details that depend on your agreement.
Completed in writing and returned to you directly.