Security and governance
Client details going into AI tools, nobody sure who can see what, nothing to show a regulator: we fix these in the systems you already run, or build new ones that cannot have them. Every system we build also comes with the protections further down this page as standard.
Where it starts
These come up again and again, in every trade and every country we work in.
We put SCRS in front of the AI your team already uses, so names and identifiers become tokens before any model sees them, and every AI call is logged.
SCRSRoles and permissions down to the field, enforced on the server, with a tamper-evident log of every access, change, refusal and export.
access controlJoiner, mover and leaver flows: one action removes a leaver from everything, and the record of what they could see stays.
offboardingSubject access requests, consent records and deletion run inside the software, so a request is answered from one place, on time.
data rightsRecords of processing, impact assessments and consent registers kept by the system, with an audit trail of what happened, so evidence is a report rather than a scramble.
governance registersThe hosting region is agreed at scoping, written into the contract and set up on deployment.
data residencyWe harden what you run, or rebuild it to our standard: parameterised queries, a strict content security policy, HTTPS with HSTS, rate limits, and no framing by other sites.
hardeningNothing sends itself. The AI drafts, a named person releases it, and a message to someone who never agreed to that channel is refused, with the reason on screen.
a person in the loopHow it works
The same measured approach as everything we build, ending in evidence you can show.
Where client data lives and travels, who can see it, which AI tools are in use, and which laws and house rules apply to you.
a review firstEvery control, register and setting is written down and agreed, with who owns each one, before anything changes.
agreed before work startsSCRS in front of your AI, access and logging in your systems, registers and residency set up, and weak spots hardened, in what you already run or in a new system.
in your systemsAudit trails, registers and reports you can hand to a regulator, an auditor or a client, kept up to date as part of looking after the system.
evidence on demandTell us how your business runs.
Start a projectSCRS · patent-pending
SCRS is the firewall from Pop Hasta Labs that sits between your system and the AI model whenever your system uses AI. Its architecture is patent-pending, and we will not call it patented until the patent is granted.
Anything outside your remit stays out of the answer. No access means no results, not all results.
Every AI call is logged where nobody can quietly edit it, ready to show a regulator, an auditor or a client.
Personal details become tokens before any model sees them, and come back only for the people allowed to see them, at the moment they need them.
If anything goes wrong, SCRS returns nothing rather than guessing. When someone leaves, their access goes with them.
Governed by SCRS
Names and identifiers are swapped for tokens before any AI model reads them, and the real details come back only for the people allowed to see them.
Tell us how your business runs.
Start a projectApplication security
Writing these down makes them a standard we hold ourselves to on every build.
Parameterised queries throughout. No SQL is ever built from strings.
A strict Content Security Policy, and output escaped by default.
Frame embedding is denied, so your system cannot be loaded inside somebody else's page.
HTTPS enforced, with HSTS and secure cookies. There is no plain-text way in.
Rate limits that fail closed, with captcha and honeypots on every public form.
Caps per team and per seat, with a warning before the limit rather than a bill after it.
Edge filtering in front of the application, set up when we deploy.
Roles decide what each person can see and change, down to the field, enforced on the server. One action removes a leaver from everything.
Data security
The system can draft a message, but a named person releases it.
Every action, refusal and override is written to a log that nobody can quietly edit.
Where your data is stored is agreed at the start of every project and written into the contract.
Tell us how your business runs.
Start a projectCompliance
The rules your build is made to keep, and the claims we do not make. Both are worth knowing before you brief anybody.
Subject access requests, consent records, deletion and an audit trail all run inside the software.
The same controls, and personal details are swapped for placeholders before any third-party AI model is called.
Consent recorded, deletion on request and a record of what was done. Pop Hasta is a registered Indian company.
The same controls, and the demos already run in Arabic and price in dirhams. The estate agency demo keeps a different rule in Dubai than in England and Wales, because the law is different.
The Act asks for a record of what your AI does, a person in the loop and the means to show both. Every AI call is logged, and nothing sends without a person releasing it.
The conflict check, the reflection period, the right to work date, the consent before the message. The part a general-purpose CRM cannot do, and the part we write for you.
Most privacy laws want the same four things: know what you hold, delete it when asked, keep a record, and keep it where you said you would. That is built in, and it travels.
Not certified. The controls are built and running, but the audits are not done, so we do not call them done.
Same controls means the software does what that law asks for. It does not mean we are your lawyer, and we will say so in the room.
This site
Everything on this site is served from our own server. We load no third-party trackers, fonts or scripts, and our demos are blocked by the browser from sending anything anywhere. Our privacy notice has the details.
We'll show you what it could look like, measured to fit before anything is built.