AI helps us do the work. A clear review process and agreed information-handling arrangements help us do it responsibly.
MEET YOUR FIRST PAIR OF EYES
Bill checks first. A human checks next.
Bill is our AI Quality Assurance Lead. His role is to give the work produced by our AI team a first pass: compare it with the brief, highlight gaps and inconsistencies, and flag anything that needs a closer look.
Bill is an AI identity, not a qualified human inspector. His review supports the process; responsibility for approving the work stays with a person.
Bill checks the draft against the instructions and available source information. He looks for missing sections, conflicting figures, unclear assumptions and details that do not match.
For example
Bill looks for issues such as a missing allowance in an estimate, inconsistent programme dates or RAMS referring to the wrong equipment. Potential issues he identifies are flagged for human review.
02
Human review
Mehmet or the agreed human reviewer checks the work and Bill’s findings against the actual job. Figures, calculations, assumptions and practical suitability are checked, and any unresolved questions are taken back to you.
The real-world check
Does the method suit the site? Are quantities and rates supported? Can the proposed sequence actually be delivered?
03
Approval before issue
Corrections are made and the final version is approved by the responsible person before distribution. Where specialist design, safety or other sign-off is needed, that review is agreed and completed before the work is issued for use.
A clear final version
Drafts stay marked as drafts. The approved document is saved in the agreed place, with its version and any conditions of use clear.
Checks reduce the chance of errors; they do not make AI infallible. Identified uncertainties are raised for review rather than treated as facts. Bill’s first pass supports human checking and does not replace it.
YOUR BUSINESS INFORMATION
Agree the boundaries before we begin.
Payroll details, client records, prices and project documents need careful handling. We agree how your information will be accessed, used, stored and returned as part of setting up the work.
Agree where your information lives.
Before work starts, we agree where source files, working drafts and final documents will be held. This can be in your own business folders—such as SharePoint, OneDrive or Google Drive—or another agreed secure workspace. We agree any temporary copies needed for the work and how they will be removed.
Give access only where it is needed.
We agree which people and tools need access, and what they are allowed to read or change. We use named accounts, restricted sharing and multi-factor authentication where supported. Access is reviewed when the work changes and removed when it is no longer required.
Be clear about what AI can see.
We agree which information may be processed by ChatGPT or other tools before connecting them or supplying files. We check the chosen service’s data settings, retention and suitability for the task. Where practical, we remove names and unnecessary sensitive details. Keeping a file in your own folders does not mean its contents stay there if an AI service processes it.
Keep a clear handover and finish.
We agree confidentiality, retention and deletion arrangements as part of the engagement. Working drafts and approved versions are clearly identified, with final files handed over to the agreed location. Your business information is used for the agreed work; sharing it with anyone else requires an agreed basis and appropriate access.
Your folders can remain the home for the work.
For example, your project information can stay organised in your SharePoint folders, with access limited to the agreed files. Drafts go into a working folder; reviewed documents go into an approved folder. Any AI processing outside that storage is explained and agreed before it happens.
CAPITAN PM / DATA & SECURITY
How Capitan PM stores your information.
Primary hosting in London
Capitan PM uses Supabase for its database, account services and file storage. Our project’s primary hosting region is London, UK. This describes the primary hosting location, rather than a guarantee that every supporting service processes data only in the UK.
Encrypted storage and connections
Supabase encrypts customer data at rest using AES-256 and in transit using TLS. Capitan Consult remains responsible for the application’s configuration, permissions and access controls.
Infrastructure assurance
Supabase is SOC 2 Type 2 compliant and ISO 27001 certified. These credentials cover the provider’s assessed scope; they are not a separate certification of Capitan Consult or Capitan PM.