Nothing leaves your estate. Not even to an AI provider.
Multi-entity, multi-jurisdiction close with structural tenant isolation, cryptographic audit proofs, and a full audit trail behind every figure — your questions and documents are not sent to outside AI providers.
Question
What is the income tax on £60,000 in the UK for 2024/25?
Employment income £60,000
Calculator£11,432
| Band | Amount | Rate | Tax |
|---|---|---|---|
| Personal allowance | £12,570 | 0% | £0 |
| Basic rate | £37,700 | 20% | £7,540 |
| Higher rate | £9,730 | 40% | £3,892 |
Sources
- 1Income Tax Act 2007s.10 — Income charged at the basic, higher and additional rates · UK Parliament
- 2Income Tax rates and Personal AllowancesRates and thresholds for 2024 to 2025 · HMRC
Claim-by-claim support
- Personal allowance is £12,570[2]
- Basic rate band is £37,700 at 20%[1]
- Higher rate applies above the basic rate band[1]
- Total tax is £11,432calc
uk-income@2024.4 · sources checked 2026-10-10
The blockers are never the features.
A finance team can usually see whether a product does the work. What stops a purchase is the column in someone else's spreadsheet that cannot be filled in.
Data cannot leave the perimeter
A tool that sends client financials to an outside AI provider is a data-transfer question before it is a software question, and that question is usually answered no.
An AI dependency is a vendor dependency
If the capability rests on someone else's AI service, then their pricing, their terms, their deprecation schedule and their availability are all yours to carry — and none of them are in your contract.
Isolation has to be provable, not asserted
Every vendor says tenants are isolated. What an auditor wants is the mechanism, and whether a developer could write a query that forgot.
The audit trail is the product
For a controlled close, an action nobody can attribute is an action that did not happen properly. Reconstructing after the fact is not the same as having recorded it.
Retention and legal hold pull in opposite directions
A deletion schedule you must honour, and records under dispute you must not delete. A system with only one of those creates a problem with the other.
Multi-entity close is where consistency goes
Different entities, jurisdictions and currencies, closed by different people to different standards, consolidated as though they were the same.
The columns, filled in.
Each of these is a mechanism rather than a policy statement, because a policy statement is what you write when there is no mechanism to point at.
Structural tenant isolation
Every workspace is isolated by design: queries are always scoped to one tenant, and each tenant's documents are searched separately, so one client's data cannot surface in another's results.
Each workspace is isolated by design, so one client's data cannot appear in another's results.
The mechanism8-role RBAC, declared once
One role-by-permission matrix, declared once and shown in the admin, rather than permission checks distributed through the code where one of them is always stale.
8 RBAC roles.
The full matrixCryptographic audit proofs, monthly
A signed proof generated for every tenant with prior-month activity, with a SHA-256 recorded at generation and verification that re-reads the stored document and compares in constant time.
Monthly cryptographic audit proofs with SHA-256 verification.
Audit and proofsRetention with legal hold on top
Configurable retention with a seven-year default for tax documents, a report listing what is due for deletion, and a hold flag that blocks deletion for records under dispute or audit. Deletion itself is audit-logged.
Multi-entity close with a checklist
Double-entry close checklists across entities, an anomaly scan that cross-references commerce records against the tax ledger nightly, and a ledger hash-chained per tenant so a later edit is detectable.
Ledger entries are hash-chained per tenant, and a command validates the whole chain.
The path a purchase actually takes.
Mapped out because the questions arrive in this order every time, and having the artifacts ready is worth more than having them available on request.
- 01
Security and trust review
The trust centre names the mechanism for each control rather than the category, so a reviewer can answer most of a questionnaire without sending one. No compliance badge appears anywhere on the site, because none is held.
- 02
The documents
Security posture, privacy posture and the AI governance statement are open. The data-processing description, the incident process and the DPA template are available with contact details, because a procurement process expects those to be attributable.
- 03
Pilot on one entity
Coverage profiles are seeded per jurisdiction, and a jurisdiction not seeded is one the assistant abstains on. Canary one workspace, gate per tenant, and let the readiness verdict decide when high-risk features turn on.
- 04
Readiness verdict
One live verdict on whether the system is safe to answer, with a plain explanation of anything missing. A new workspace correctly returns not-ready; when the system is not ready, high-risk workflows are disabled while low-risk help stays available.
- 05
Incident rehearsal
Every answer can be traced back to the sources it used and reviewed again later.
Security and trust review
A completed first pass on the security questionnaire, with the answers traceable to specific implemented controls rather than to policy language.
Step 1 of 5 — Security and trust review
Four procurement questions, one answer.
Keeping outside AI providers out of the request path is usually presented as an engineering preference. For an enterprise buyer it closes four separate risks at once.
No data egress, because there is nowhere to send it
Your questions and documents are not sent to outside AI providers.
Your questions and documents are not sent to outside AI providers.No licence risk and no pricing exposure
No outside AI vendor bill passed on to you, no licence terms that change under you, and no dependency on a provider's commercial decisions. Every change is versioned and can be rolled back.
No outside AI vendor bill passed on to you, and no dependency that can be withdrawn from under you.No dependency on someone else's roadmap
If a component fails, the system falls back to its previous healthy version — never to an outside AI service. A deprecation notice from an AI vendor is not an incident here, because there is no such vendor.
No dependency on an outside AI vendor's pricing, terms or availability.Every high-risk action attributable
Actor, tenant, event type and recorded versions on every AI interaction and every high-risk action, with refusals logged separately and their reasons recorded. A CLI command exports the log for durable retention.
A full audit trail records who did what, and an auditor role has read-only access to it.
Viability, support, setup, change.
The four that come from outside the finance team. Two of them have honest answers that are not entirely comfortable, and those are given as they are.
Start with the trust centre, not the demo.
The security review is the long pole on a purchase like this, so it is the part that is already written down. Read it first and bring the questions it does not answer.
Decision support, not tax advice. A professional reviews before anything is filed.