Compliant by design
Built in from the first release, not added later.
The idea
Only what you need, with the rules built in.
Most compliance problems start with technology that was put together first and checked later: a form that collects more than it should, a text sent without consent, an automation nobody watches.
We work the other way round. We start by working out what a business does not need, then build the rest with consent, privacy, access and audit designed in, and run it with a person in charge of every automated action.
The method
Five steps, every time.
- 01
Assess
What the business does, the rules it lives under (health, finance, texting, data protection), and what it does not need.
- 02
Blueprint
The smallest set of pieces that does the job, with the controls for each written down.
- 03
Build
Consent, privacy, access and audit are built in from the first release.
- 04
Run
Monitored, maintained and improved, with a person in charge of every automated action.
- 05
Measure
Where leads come from, what converts, what it costs, and what to change next.
The evidence
What is built in, and live, today.
Every item below is running on the Ceety Platform now. Described by what it does for your business, not by badges.
Privacy and consent
Consent is recorded with the exact words the person agreed to, where and when. Service and marketing consent are separate, and no box is ever pre-ticked.
Opt-outs are honored everywhere at once: STOP and the carriers’ standard opt-out words, unsubscribe links on every email, and a suppression list checked before every send.
Each client has a kill switch that stops all outgoing messages instantly.
Personal details are never put in web addresses. Links carry a short signed reference instead.
Social Security numbers are encrypted, only the last four digits are shown, and every full view is logged with a reason. Card numbers and SSNs are never imported from old systems.
Security and separation
Each client’s data is kept separate, and automated checks run on every change to prove it. One login belongs to one business.
Each client gets its own sending domain and its own private, encrypted file storage.
Secrets are held in an encrypted vault, never in code.
Sign-in has three layers of checks, and only staff with a role get in.
An audit trail records who did what, and it cannot be edited.
Forms are protected against bots with Cloudflare Turnstile.
Safe AI
A person approves every action the AI proposes. The AI never sends a message, approves a payment or changes a rule by itself.
The assistant spots prompt-injection attempts and flags requests for legal, tax, medical or insurance advice.
AI can be switched off per client, and there is a global kill switch. Every guardrail event is logged.
Ceety SEO follows the same pattern: the AI drafts, a person approves, the result is verified.
Automations are cautious by design. A “NO” reply to a reminder creates a task for a person; it never cancels anything.
Safe AI
The AI drafts. A person decides.
AI is useful for answering questions about your own records and drafting the next step. It is never allowed to act alone. Every proposal waits for a person, and approving a draft only opens it for a person to send.
- 01
The AI drafts
A reply, a task or an appointment, from your own records.
- 02
A person reviews
Your team sees the draft and what it is based on.
- 03
A person acts
Only then is it sent or saved. Every step is logged.
- Requests for legal, tax, medical or insurance advice are flagged, prompt-injection attempts are spotted, and AI can be switched off for your business at any time.
For a small business
What it means when you’re a team of ten.
Texting that follows the rules
Consent is recorded with the exact words the person agreed to, STOP is honored everywhere, and carrier registration is done for you.
Your customers’ data, kept apart
Your data is kept separate from every other client’s, in private, encrypted storage. And it is always yours to export.
No automation without a person in charge
The AI drafts; a person approves. A “NO” to a reminder becomes a call for your team, never a silent cancellation.
Everyone has their own login
Unlimited staff users, because shared passwords aren’t compliant. Every action lands in an audit trail that cannot be edited.
Evidence when someone asks
When a partner, an insurer or an auditor asks how you handle data, there are controls they can check and records to show them.
You don’t have to become an expert
We build it in, keep it running and keep it current. You approve what changes.
For regulated work we build to the frameworks that apply, such as HIPAA and GDPR, and describe it as aligned with or audit-ready. We sign a BAA when an engagement involves protected health information. More on how we protect data in the Trust Center.
Questions
Frequently asked.
- Does compliant by design make my business compliant?
- It gives you controls your auditor can check, built in from the start. Whether a business is compliant also depends on its own policies and how it runs day to day. We build the controls in and write them down in your blueprint.
- Can the AI send messages or make changes on its own?
- No. A person approves every action the AI proposes. The AI never sends a message, approves a payment or changes a rule by itself, and it can be switched off for your business entirely.
- What happens when a customer texts STOP?
- The opt-out is honored everywhere at once. STOP and the carriers’ other standard opt-out words are recognized, and a suppression list is checked before every send.
- Do you sign a Business Associate Agreement?
- We sign a BAA when an engagement involves protected health information.
- Is my data mine if I leave?
- Yes, whichever way you work with us. Your data is always yours, and you can export it at any time.
See what’s included on each plan on the pricing page, or how an engagement runs on how we work.
For a small business, start here: what compliant by design means for a 10-person business.
Tell us about your business.
Book a free consultation: a conversation about what you have and what you want. We’ll tell you honestly what you don’t need. Free, with no obligation.