Compliance and regulatory framework

1. Regulatory position

1.1 MetaAshes is operated by MetaFenix Management Ltd, company number 16921717, registered in England and Wales.

1.2 MetaAshes is an information service. It does not recommend investments, arrange or manage investments, or hold or transfer client money, and MetaFenix Management Ltd is not authorised by the Financial Conduct Authority.

1.3 MetaAshes is independent of, and not endorsed by, the Financial Conduct Authority, Companies House, HMRC, the Information Commissioner's Office or the Foreign, Commonwealth & Development Office. We use the information these bodies publish; we do not speak for them.

1.4 MetaAshes is not a law enforcement agency, investigator or recovery service, and cannot act on behalf of anyone who has lost money.

2. Data sources

2.1 Assessments draw on the following official and public sources, retrieved directly from each source at the time of the assessment or from a recently refreshed copy:

• FCA Financial Services RegisterRefreshed hourly
• Companies HouseRefreshed hourly
• UK Sanctions ListRefreshed daily
• HMRC Alcohol Wholesaler Registration SchemeRefreshed daily
• HMRC money laundering penaltiesRefreshed daily
• Information Commissioner's OfficeRefreshed daily
• OpenFIGIRefreshed hourly
• Domain registriesRefreshed hourly
• Certificate Transparency logsRefreshed daily
• Mail and web recordsQueried live
• Ofcom numbering dataUpdated monthly

2.2 Information Commissioner's Office register data is used under the Open Government Licence v3.0. We do not alter the substance of source data, and we do not guarantee its accuracy, which remains the responsibility of the publishing body.

3. Data protection

3.1 MetaFenix Management Ltd is registered with the Information Commissioner's Office under reference ZC187194 and processes personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

3.2 The Service is designed to collect as little personal data as possible:

• assessment answers are held in memory only for the duration of a session and are never written to our database;
• uploaded documents are read once to pre-fill an assessment and are not stored by us;
• verification history is limited to the firm name, pathway, verdict, score and date;
• IP addresses used to limit repeated attempts are held in memory for no more than one hour;
• only strictly necessary cookies are used, fonts are self-hosted, and no analytics or usage tracking is enabled.

3.3 Users can change their email address, change their password or permanently delete their account at any time. Full details of the data we process, our lawful bases, retention periods and your rights are set out in our Privacy Notice and Cookie Policy.

4. Security controls

• Passwords are stored only as salted PBKDF2-SHA256 hashes and are never stored or logged in readable form.
• Sign-in sessions use randomly generated identifiers held in secure, HTTP-only cookies, and are revoked on sign-out, password change or account deletion.
• Form submissions from other websites are refused, protecting accounts against cross-site request forgery.
• Each assessment is opened with a single-use, time-limited link, and a check is deducted atomically only when the assessment runs.
• Repeated sign-in attempts, enquiries and assessments are rate limited.
• Communication between the website and the assessment engine is authenticated with a shared secret that is never exposed to browsers.

5. Assessment integrity

5.1 Every score is calculated from 102 defined scoring rules across 58 checks. Identical information always produces an identical score.

5.2 The score is calculated before any artificial intelligence is involved. AI is used only to draft the plain-English explanation of findings that have already been determined, and to read uploaded documents for the user to review. A consistency review flags contradictions but cannot change a score.

5.3 Our rules include safeguards against false conclusions, so that a genuine firm is not marked down for trading under a registered trading name, for recent authorisation or for sharing a common name with another person or company.

6. Fairness and right of reply

6.1 Assessments are private. Each is visible only to the user who ran it, and MetaAshes does not publish ratings, lists or verdicts about firms.

6.2 Users agree under our Terms of Use not to present an assessment as a statement of fact that any firm or individual has acted unlawfully.

6.3 A firm or individual who believes that our rules have produced an unfair result, or that a source we rely on contains an error, may contact us. We will review the concern and, where appropriate, correct our rules. Errors in official registers must be corrected by the publishing body.

7. Payments and consumer rights

7.1 Checks are sold as one-off packs with no subscription or recurring charge. Payment is made by UK open banking through Apron Payments Ltd, registered with the Financial Conduct Authority as an electronic money institution (FRN 1004915). We do not receive or store card details or online banking credentials.

7.2 Each order carries a unique payment reference, and checks are added only after the full amount has been confirmed as received against that reference. The consents given at checkout are recorded with the order.

7.3 Consumers may cancel within 14 days of purchase and receive a refund for unused checks. Full details are set out in our Payment and Refund Policy.

8. Reporting fraud

8.1 If you believe you have been defrauded, contact your bank immediately, then report the matter to Action Fraud on 0300 123 2040 and to the Financial Conduct Authority. Reports of suspected clone firms can also be sent to us through our contact form.

9. Complaints

9.1 Complaints about the Service can be made through our contact form. Complaints about our handling of personal data may also be made to the Information Commissioner's Office.