Regulated buyers need evidence, not adjectives. This page summarises the 26 policies, frameworks and plans that govern how Navitra builds and runs AI, protects data, handles complaints and chooses suppliers. Full documents are available to clients and prospective clients on request.
Our AI supports the assessment of individuals’ creditworthiness, a use treated as high-risk under the EU AI Act. We apply our strongest controls to it and give lenders the evidence they need for their own model risk management, including under PRA SS1/23.
| Safety, security, robustness | Models validated before release, pinned in production, monitored, and protected against prompt injection |
|---|---|
| Transparency, explainability | Every recommendation shows its main factors and the policy rules applied |
| Fairness | Outcomes tested for unfair differences between groups, before release and monthly |
| Accountability, governance | A named owner, documented risk assessments, change control and Board oversight |
| Contestability, redress | Underwriters can override any recommendation; customers can be routed to fully human underwriting |
Navitra is not authorised by the Financial Conduct Authority. Our clients are, and they stay responsible for their customers. Our job is to make sure our service helps them meet their duties and gives them the evidence to show they have.
| Consumer Duty | Product changes checked against the four outcomes; monthly outcome reporting to each client |
|---|---|
| FG21/1 vulnerable customers | Vulnerability indicators routed to a person; outcomes for flagged cases monitored monthly |
| DISP complaints | Evidence for complaints about AI-informed decisions within 5 working days |
| PRA SS1/23 model risk | Model cards, validation and fairness results, pinned versions and change notices |
| Record keeping (MCOB, SYSC, MLR 2017) | Client records kept to each lender’s retention rules, with legal holds when needed |
| Supplier due diligence | FSQS registered through Hellios (no. 10104245), renewal due 7 November 2027 |
| UK GDPR and DPA 2018 | Processor on the lender’s instructions; ICO-registered controller for our own data |
Internal planning targets, confirmed each year by our business impact analysis and tested through restore exercises. Contracted service levels are set out in each client contract.
| Service | Recovery time | Maximum data loss | Impact tolerance |
|---|---|---|---|
| Hosted underwriting support | 24 hours | 1 hour (hourly backups to a second provider) | 48 hours; underwriters continue manually meanwhile |
| Client support and incident communication | 4 hours | Not applicable | 24 hours |
| Releasing fixes, including for client-hosted deployments | 48 hours | None (code held in version control) | 5 working days |
How models are built, validated, monitored and corrected.
How Navitra develops, operates and uses AI responsibly, safely, fairly and transparently.
How the data models depend on is measured and kept accurate.
How every recommendation is traced back to its source.
How operational risks, including model and AI risk, are identified, scored, controlled and reported.
How the service supports lenders’ duties to their own customers.
How the service helps lenders deliver good outcomes under the FCA’s Consumer Duty.
Making sure the service never leaves a vulnerable customer worse off, in line with FCA FG21/1.
How complaints from clients are handled, and how lenders are supported with their customers’ complaints.
How personal data and records are handled, kept and destroyed.
How personal data is processed lawfully, fairly and transparently, as controller and as processor.
How records are kept accurate, available, retained only as long as needed and destroyed securely.
Keeping client data inside approved systems and setting rules for company equipment.
How systems are protected, tested and recovered.
The security standards Navitra applies to its people, systems, data and suppliers.
Cyber security governance, asset management, detection and the secure development life cycle.
How vulnerabilities are found, rated and fixed.
How security incidents are detected, contained, recovered from and reported.
How cloud services, environments, changes and technology lifecycles are managed.
How Navitra plans for disruption and keeps clients informed during it.
How bribery, fraud and conflicts are prevented, and how concerns are raised.
Zero tolerance of bribery, with the adequate procedures expected under the UK Bribery Act 2010.
Zero tolerance of fraud, and a plan for the first 24 hours if it happens.
How conflicts are declared and managed, and the rules on gifts and inside information.
How anyone can raise a concern safely, including clients, suppliers and their staff.
How Navitra treats its suppliers, its people and the environment.
How suppliers are chosen, monitored and exited safely.
The minimum standards expected from suppliers and their own supply chains.
Fair labour practices and zero tolerance of modern slavery.
A workplace free from discrimination, bullying and harassment.
Preventing injury and ill health in remote and office work.
Understanding and reducing environmental impact and preparing for climate risk.
Anyone who works for or with Navitra, including clients, suppliers and their staff, can report suspected wrongdoing: fraud, bribery, data misuse, manipulated or hidden model results, harassment or modern slavery. Reasonable belief is enough; proof is not needed. No one will suffer any detriment for raising a genuine concern.
| Director | jaydev.bhatt@navitratech.com |
|---|---|
| Company mailbox | contact@navitratech.com |
| Without giving your name | navitratechnologies@gmail.com, from an email account that does not identify you |
| Independent advice | Protect, the free, confidential whistleblowing charity |
| Regulators | The ICO (data), the FCA (financial services), the HSE (safety), the Serious Fraud Office (fraud and bribery) or HMRC (tax). You do not have to report to us first. |
We acknowledge concerns within 3 business days. For a complaint about our service, use our complaints process instead.
Clients and prospective clients can request any of these documents, our incident response plan, a completed due diligence questionnaire, or our data processing agreement.