AI development company for UK teams that ship.

Yes. Our engagement defaults are aligned with UK GDPR and the Data Protection Act 2018. DPAs (UK GDPR controller-to-processor or processor-to-processor as appropriate) are signed before any personal data is shared. For engagements processing personal data at scale or involving special category data, we run a Data Protection Impact Assessment (DPIA) aligned with the ICO's published guidance. Standard contractual clauses (UK IDTA or the EU SCCs with the UK addendum) cover any necessary international transfer of personal data. Audit logs on every model and tool call are exportable for ICO inspection.

Yes. We sign UK GDPR-aligned Data Processing Agreements covering the Article 28 obligations: processing only on documented instructions, confidentiality of personnel, security of processing, sub-processor management, data subject rights assistance, breach notification, and deletion or return of personal data at the end of the engagement. We will work from your DPA template or provide ours. If your engagement involves NHS data, we follow the Data Security and Protection Toolkit principles in addition to the standard UK GDPR controls.

Your call. We default to AWS London (eu-west-2), Azure UK South, or GCP europe-west2 for UK clients, and we will run the entire build inside your UK or EU cloud account if your data protection officer requires no cross-region replication and no data egress to non-UK endpoints. For inference, we pin Claude or GPT-4o to a UK or EU region where available, or we self-host Llama 3 on vLLM inside your VPC for zero third-party inference. We do not silently route UK personal data through non-UK endpoints.

Strong. India Standard Time is GMT+5:30, which gives roughly four to five hours of native daily overlap with UK business hours — our 1:30pm IST is your 8am GMT, and our 6:30pm IST is your 1pm GMT. Daily standups, twice-weekly demos, and most ad-hoc problem-solving land inside that window without late-night calls on either side. For UK clients who prefer afternoon-onwards working, we can extend our coverage to 8pm IST (2:30pm GMT) on a planned cadence. Written async updates go out daily before your standup.

Most v1 engagements at Aiinfox land between £20,000 and £100,000 fixed-price for a focused build — an AI agent, a RAG system, a voice pipeline, or a bespoke ML model. Larger multi-quarter engagements with fine-tuning, custom evals, and FCA-aware compliance work typically reach £150,000 to £250,000. Pilots are usually £8,000 to £20,000 with acceptance criteria written into scope. UK clients invoice in GBP via bank transfer or USD via wire — VAT does not apply on B2B services exported to UK from India (general rule; your accountant should confirm against your specific situation).

Yes — that is the most common UK deployment pattern we run. We work inside your AWS, Azure, or GCP account in any UK or EU region you specify, using your IAM, your VPC, and your customer-managed encryption keys. For inference, we route to UK or EU endpoints on Claude (Anthropic) and GPT-4o (Microsoft Azure OpenAI Service in UK South), or we self-host Llama 3 on vLLM inside your VPC if your team requires zero third-party inference. No data leaves your cloud unless your runbook says it should.

Yes. We have shipped KYC automation, fraud signal extraction, deterministic-output compliance copilots, and audit-trailed claim handling for fintech and insurtech operators in the UK and EU. We treat FCA Senior Managers and Certification Regime (SM&CR) accountability seriously — every model and tool call is audit-logged with input, output, prompt version, and operator identity, so the senior manager accountable for the system has the evidence they need. We do not make autonomous regulatory decisions; humans approve everything that touches a regulated outcome.

Yes — takeover audits are routine. Step one is reading the code, the data pipelines, the eval results (if any exist), the prompts, and the cost telemetry. Step two is shipping the smallest valuable change to prove we understand the system. Step three is the longer-term plan — incremental stabilisation, a parallel rebuild, or shutting it down and starting over. Most takeovers we see did not need a full rewrite; they needed evals, guardrails, observability, and a senior engineer on the build. We will be honest on the first call.