The graph has to live where you control it
Three hops in, the core idea is set. The graph records context, permission and provenance for every decision made on it. Human and AI contributions sit in the same record. Replay lets you go back to any point and see what was known.
The next question is the one every organisation eventually asks. Where does this record live? And who controls it?
It sounds like an IT question. It is not. It decides whether the chain of evidence the graph keeps is complete or has a gap in it. And a chain of evidence with a gap is not a chain of evidence. It is a document that looks like one.
The principle underneath
The principle is not really about servers. It is about chain of custody: being able to show who held a record, who changed it and when, at every step.
The graph holds the reasoning behind important decisions. What was in scope. Which permissions applied. Which AI version ran. What the person decided. That record is valuable because it is complete.
The moment it passes through hands you cannot account for, completeness becomes a claim rather than a fact. You are saying nothing was changed or copied along the way, but you cannot prove it. When a record is questioned, the difference between a claim and a proven fact is everything.
That is why control sits at the heart of how we build. The graph has to live where its owner controls it, because otherwise the evidence it holds cannot be trusted at the very moment you need it.
Three kinds of record. One rule. Different reasons.
Our products hold three quite different kinds of record. Each needs control for its own reason.
Public directory records. Care Tech Directory, Care Robotics Directory and Clinical Research Directory are free to search. But free to read does not mean anyone can change them. Each directory keeps authority over its own facts, identifiers, sources, rights, corrections and withdrawals. When a supplier corrects a listing, or a source asks for something to be removed, that change has to reach every place the fact is used. If copies of the data drift around in other systems, a correction never catches up with them. So MIA does not keep its own copy of the directories. It asks each directory, which stays the single source of truth for its facts.
Private market-access work. Companies planning NHS or international entry share sensitive material with our consultants: unreleased evidence, pricing, target buyers, weak spots in their case. That work sits in the Consultant Cockpit, separate from the public directories and from other clients. Only a reviewed public view of anything ever reaches the Care Commissioning Directory. A company's strategy should never be one search away from a competitor.
Clinical research records. Trial data comes with rules. Registries such as ClinicalTrials.gov and ISRCTN publish under specific terms, and some sources are excluded because their terms do not allow our use. Personal data is kept out of AI processing. The chain of evidence has to respect those rules at every step, because a record that points to data it was never allowed to hold is not evidence. It is a liability.
Three kinds of record. One rule. The reasoning behind important decisions should never be handed to a place its owner cannot account for. The reasons differ in each case, and that matters when you explain it to a board, a buyer or a regulator.
Not every organisation has a data team
Large NHS trusts and global manufacturers often have teams who can run their own systems. Most of the organisations we serve do not. Small care-tech suppliers. Care providers. Local councils. Early-stage robotics companies. University research groups.
They need the same guarantees: their facts are correct, their private work stays private, and the record behind their decisions can be checked. They should not need an infrastructure team to get that.
So the guarantee is built into the products. The directories are free to search, with sources and dates on every record. Payment never changes what is listed, the order of results or the facts in the graph. Private work is kept in separate workspaces. Separate private databases are never mixed into one shared pool.
What is never on the table is pooling everyone's private data together. However neatly it is divided, a shared pool turns the chain of custody into a promise rather than a fact.
Control is not about who owns the hardware. It is about who controls the record, who can change it and whether every change can be traced. Get that right and the evidence holds. Get it wrong and no amount of security wording will fix it.
What this means in practice
When you choose tools for important decisions, the real question is not where the servers are. It is whether you can show that the record behind your decisions has a complete chain of custody when someone asks.
Someone will ask. A procurement challenge. A clinical safety review. A funder's audit. A board asking how an AI tool shaped a big decision. Each time, you will need to show what was known, what ran and what the person understood. The chain of evidence is your proof. Its completeness is what turns it from a story into evidence.
An organisation whose record lives where it is controlled, with no gaps in custody, walks into that moment with something most do not have: a record that proves what it says.
Those without it cannot fix it when the moment arrives. Evidence gathered after the fact is paperwork. Evidence captured at the time, in a record its owner controls, is proof. And once the moment has passed, you cannot go back and capture it.
What comes next
Hop 4 is the control argument. Where the graph lives, why chain of custody is the base everything else stands on, and how the same rule applies to public, private and research records.
Hop 5 looks at scale. One well-recorded decision is useful. Thousands of them, recorded the same way, show something no other system can: how well an organisation really knows what it thinks it knows.