We are an assurance company, so our own posture has to survive the scrutiny we apply to others. We are working towards Cyber Essentials; we do not yet hold it and claim no certification.

Email inquiries@ukaievaluation.com with the subject SECURITY, including reproduction steps and impact. We acknowledge within five working days. Please do not open a public issue for a security report.

• It reads CSV files of scores and labels and writes a JSON file. It makes no network calls, executes no model, and imports nothing outside the Python standard library.
• It never needs model weights, images or patient-identifiable data. If you are evaluating a clinical model, keep the optional group column pre-coded (opaque stratum labels) unless a data processing agreement covers it.
• Treat every prediction file as sensitive regardless. Keep them out of this repository: .gitignore excludes the common data extensions, and CI runs a secret scan on every push and pull request.