Security & data
What happens
to your data.
DCA RouteLab is a browser-first commercial reasoning tool for UK local-authority capital decisions. The underwriting flow runs in your browser. No resident data, no service-user data and no special-category data is required to use it — and none is sent to our infrastructure as part of the reasoning flow.
For your IG team — copy & paste
In one paragraph.
“DCA RouteLab is a browser-based commercial reasoning aid for UK Section 151 officers and procurement leads. The underwriting session — project facts, condition ratings, route selections, canvas notes and the officer call — runs locally in the user’s browser. Inputs are limited to commercial and project parameters; no resident data, no service-user data and no special-category data is required or accepted. Account sign-in uses a managed authentication backend; the project record itself is held in the browser unless the officer explicitly saves it to the authority workspace. A DPIA is not expected to be triggered by the reasoning flow itself; a short LIA may be appropriate if officer email is recorded for pilot administration.”
Security and data details
The quick read
Four questions, four answers.
What data is processed?
Only the commercial and project parameters you type or select during an underwriting session — project name and value, route choice, the twelve condition ratings, evidence notes, flags, assumptions and the officer call. The tool does not request, accept or use resident or service-user data, and is not designed for special-category data.
Where does it live?
Entirely within your browser tab. We do not store, save or retain the commercial, project or confidential information you enter — there is no server-side database of your underwriting sessions. If you choose to save or export, the file goes to your own device or your authority’s own storage (SharePoint, EDRMS, shared drive). The reasoning session itself does not POST project content to our servers. Authentication uses a managed backend (Cloud) hosted in the EU.
Is a DPIA required?
We do not expect a DPIA to be triggered by the reasoning flow itself, because no personal data about residents or service users is processed. If your authority records officer email addresses for pilot administration, a short Legitimate Interests Assessment (LIA) is usually proportionate. We will provide a one-page IG note on request.
What happens at exit?
There is nothing to “disconnect”. When you stop using the tool, no project content persists on our side. Your Decision Record exports remain entirely under your control. Accounts can be closed and any associated records deleted on request.
If you want the specifics
Detail.
Authentication
Sign-in uses a managed authentication backend (Cloud, powered by a managed Postgres provider). Sessions are held in your browser and re-verified on subsequent visits. We do not operate our own password store. Single sign-on via the authority’s identity provider can be discussed for larger deployments.
Tracking & cookies
No advertising trackers, no third-party marketing pixels, no cross-site profiling. The only browser storage used is for the session token (authentication) and the in-progress underwriting session, so a page refresh does not lose your work.
The Decision Record
A self-describing record of the project facts, condition ratings, controlling lens, reshaping moves considered, the officer call, the evidence relied on and the residual exposure. It is written to your device or workspace when you choose to save or export it. The deterministic rule-set version is stamped on every record so the reasoning can be reproduced and reviewed later.
Hosting & subprocessors
The application is served as a static front-end on an edge network. Authentication and any opt-in workspace storage use a managed backend (Cloud) hosted in the EU. We do not transfer reasoning data outside the UK/EEA in normal operation. A current list of subprocessors is available on request.
Accessibility & standards
Built towards WCAG 2.2 AA. Works in modern browsers without installation. Keyboard navigation is supported through the core underwriting flow. Where issues are identified during pilots they are tracked openly and fixed in priority order.
Statutory duties
DCA RouteLab is a commercial reasoning aid. It does not discharge your authority’s statutory duties — including Best Value, the Section 151 officer’s personal responsibilities, the Public Sector Equality Duty (PSED), Procurement Act 2023 obligations or subsidy-control requirements. It is designed to make pre-commitment commercial reasoning more transparent and reviewable, not to substitute for legal, financial or specialist procurement advice.
Who is accountable
Data controller.
Controller
Darwinian Angel Ltd
Trading as Civation. United Kingdom.
Data protection queries
No designated DPO — the volume and nature of processing does not require one. Queries are handled directly by the controller.
ICO registration
Darwinian Angel Ltd has paid the ICO data protection fee and the registration number will be published here on issue by the Information Commissioner’s Office. In the interim, a copy of the fee receipt is available on request to IG teams considering a pilot.
04 — Get in touch
Questions from your IG or legal team?
Email info@darwinianangel.com or use the contact form. We respond with a written answer suitable to share internally with your IG, DPO or legal team.
Contact usThis page describes Civation’s current posture for DCA RouteLab and may be updated as the product matures. It is not a contract or a warranty. The current version can be saved as a PDF using your browser’s print dialog.