Methodology
The UK readiness score is a simple, transparent 0–100 checklist. It measures what a vendor publishes, not whether your use of the tool is lawful. Two tools with the same score can carry very different risks depending on the data you put through them.
How we research
- We only use public, first-party sources: the vendor's trust or security page, DPA, sub-processor list, privacy policy, terms and documentation. Official regulator pages are used for context.
- Every field has a source URL and a "last checked" date. The current dataset was checked on 22 October 2026.
- We never guess. If we can't confirm something from a public source, it is marked Not published and scores zero. Vendors can fix this by publishing the information or by getting verified.
- If a vendor's pages contradict each other, we use the more cautious claim and say so. For example, one vendor's security page says "SOC 2 Type 2" while its pricing page says the programme is still in progress.
- We record what the vendor claims; we have not audited anyone. Where a certificate is held by a parent company (e.g. Celonis for Make), we say so.
Scoring
| Factor | Points | Why it matters |
|---|---|---|
| UK/EU data residency | UK region available: 25 · EU region only: 15 · none or not published: 0 | Where your data lives at rest decides whether you are making a restricted transfer under UK GDPR. |
| DPA and UK transfer terms | DPA explicitly covers UK transfers (ICO UK Addendum or IDTA, or equivalent UK wording): 25 · DPA exists but UK wording not confirmed: 12 · no DPA found: 0 | Article 28 requires a processor contract; UK restricted transfers need an ICO-approved mechanism. |
| SOC 2 | Yes (audit or attestation claimed by the vendor): 10 · in progress or not published: 0 | Independent assurance over security controls. |
| ISO 27001 | Certified: 10 · in progress or not published: 0 | Certified information security management system. |
| Self-hostable | Yes: 10 · partly (e.g. vendor-managed in your cloud, or framework only): 5 · not published: 0 | Self-hosting lets you control location and access yourself. |
| Training on customer data | Explicit "no": 15 · partly (only some tiers or features, opt-out, or de-identified data): 7 · permitted or not published: 0 | Use of personal data for model training is a separate purpose you would need to justify. |
| Sub-processor list | Publicly accessible: 5 · not published: 0 | You need to know who else touches the data. |
| Total | 100 |
Bands
80+ Strong 60+ Good 40+ Mixed <40 Limited
What the score doesn't cover
- Your lawful basis, DPIA, transparency notices and retention settings.
- Data that leaves the platform through the integrations or AI models you switch on. For example, an "EU" automation platform can still send a prompt to a US model.
- Contract terms negotiated privately, which can be better than the public ones.
- Price, features or quality.
Changes to the dataset
Relay.app was on our original list but was replaced by Tines: Relay.app's website says it shut down in September 2026 and deleted all accounts (relay.app, checked 22 October 2026).
Spotted something out of date? Vendors can submit evidence.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.