Data & Security
YOUR DATA.
YOUR ENVIRONMENT.
AUCTONOMY ON TOP.
AUCTONOMY is designed so your organisation retains control of its underlying auction documents and customer data within your own authorised environment. AUCTONOMY provides the operational intelligence layer — not a replacement for your document environment.
Target Architecture
Customer Data / Documents
Your properties, sellers, purchasers, legal documents, memoranda
Customer-Controlled Environment
Your Microsoft 365 tenant / authorised storage
Authorised Least-Privilege Access
Microsoft Graph API — only required permissions
AUCTONOMY
Operational intelligence layer
Workflow + Readiness + AI + Command Centre + Property Memory
How AUCTONOMY is designed
The principles that guide AUCTONOMY's data architecture, access model and security approach.
Customer-Controlled Document Storage
Where configured, auction documents remain within the organisation's own authorised Microsoft 365 environment. AUCTONOMY accesses authorised information as required to provide its functionality — it does not unnecessarily duplicate your document archive into a central AUCTONOMY-owned repository.
Microsoft 365 Integration
AUCTONOMY is designed to integrate with Microsoft 365, Microsoft Entra ID, Microsoft Graph and SharePoint. The intended architecture allows auction documents to remain in the customer's Microsoft tenant while AUCTONOMY provides the operational workflow and intelligence layer on top.
Role-Based Access
Access to AUCTONOMY is controlled by role-based permissions. Roles include Auction Administrator, Legal Administrator, Surveyor, Solicitor, Finance, Manager/Director, Compliance Viewer and Read Only. Each role has access only to the functionality and data appropriate to that role.
Least-Privilege Approach
AUCTONOMY requests only the Microsoft permissions genuinely required for the enabled functionality. The application is not architected around unrestricted access to an organisation's entire Microsoft environment when only specific auction and document locations are required.
Organisation Separation
Each auction house is a fully isolated tenant within AUCTONOMY. One organisation cannot access another organisation's lots, documents, sellers, purchasers, workflows, communications, fees, users, Property Memory, AI results or audit records.
Audit History
AUCTONOMY maintains an immutable audit trail of operational events — document referenced, document uploaded, new version detected, AI analysis requested, workflow changed, readiness changed, solicitor chased, permission changed, integration connected/disconnected, export requested. Each event records who, what, when and what changed.
Controlled AI Processing
AI features are optional and configurable per organisation. When enabled, authorised information may be processed by configured AI technology providers. Every AI observation is linked back to its source document, version and page reference. AI features are assistive — AUCTONOMY does not provide legal advice.
Document References and Version Tracking
AUCTONOMY maintains operational metadata — document reference, category, version, external storage reference, upload timestamp, current/superseded status — without unnecessarily retaining full document content. Version history is preserved and never silently overwritten.
Integration Transparency
Organisation Administrators can review all external systems AUCTONOMY has been authorised to access through the Data Control Centre. Data direction is clearly indicated for each integration.
Customer-Controlled Connection and Disconnection
Organisation Administrators can connect and disconnect integrations, configure AI processing, manage permissions and initiate the offboarding process. Disconnecting AUCTONOMY does not delete the organisation's own document archive, which remains in the customer's environment.
What AUCTONOMY does not claim
AUCTONOMY does not claim the following certifications or standards unless they have been independently obtained and verified:
This prototype demonstrates the intended architecture and product concept. It does not constitute a production-ready security or data-protection assessment. Organisations considering commercial deployment should obtain independent legal, technical and data-protection advice.