Choose which cookies we may use. You can change your mind at any time on our Cookies page.

Read our cookie policy

Employee engagement

Insights to understand the engagement and culture across your organisation.

Employee retention

Identify and resolve retention risks in your organisation.

Team performance

Build a high performing business powered by high performing teams.

For HR consultancies

Run surveys, 360s and appraisals for your clients, with your own questions and your own model.

Trust centre

Where your data is hosted, who can see your people's answers, how our AI uses them, and how we support you.

At a glance

Hosted in London

Your data is hosted in London wherever your people are. AI processing stays within the UK and EU.

Certified and tested

Cyber Essentials certified, and independently penetration tested at least once a year.

GDPR and the EU AI Act

GDPR compliant, and meets the requirements of the EU AI Act. Your data is not used to train third-party AI models.

Role-based access control

Everyone sees what their role allows, and only that. You set the restrictions.

The ethics filter

With the ethics filter enabled (our most common setup), results are only shown for groups of six or more.

Availability

Ten Space has consistently averaged over 99.99% availability over the last three years and our standard contract includes an SLA.

Documents provided on request

Our DPA, sub-processor list and certificates are provided on request.

  • Our data processing agreement (DPA)
  • Our sub-processor list
  • Our Cyber Essentials certificate
  • Our contract terms
Request the security pack

Where your data is hosted

Hosted in London. AI processing stays within the UK and EU.

Your data is hosted in London wherever your people are. It is held in a secure virtual private cloud (VPC) on AWS.

Our sub-processor list is available on request.

Security and certification

Ten Space is Cyber Essentials certified, and independently penetration tested at least once a year. The penetration test is carried out by a trusted, CREST-certified provider.

Our Cyber Essentials certificate is provided on request.

Access and sign-in

Everyone sees what their role allows, and only that. You set the restrictions, down to a single survey. For IT teams, this is role-based access control.

One dashboard can serve every manager: each sees their own people's results on it. An alert tells the right person that an answer needs attention. What they can then see is still set by their role.

Authentication can be configured to require SSO through Google Workspace or Microsoft Entra ID. Alternatively, you can allow email address and password login, including enforcement of your own password policy.

Who sees your people's answers

With the ethics filter enabled (our most common setup), results are only shown for groups of six or more. You choose for each survey, whatever channel people answer by:

  • Filtered, with the ethics filter applied: results are only shown for groups of six or more.
  • Fully anonymous (certain features such as automated reminders and segmentation may not be available).
  • Identified, where authorised users can see which individual answered. People are told before they send any answers.

Any survey can target a single employee. Certain features are not available with so few participants.

360 feedback and appraisals are confidential, and released when you're ready. Who sees what is set by permissions you control.

360 feedback. Although the names of participants aren't shown alongside their responses, the small number taking part (typically five to ten) and their close relationship with the person mean that anonymity can't be guaranteed.

Our Employee Promise tells the people who answer what happens to their answers.

AI and your data

AI analysts specific to your sector, configured for your organisation, summarise every survey, team and question, and suggest prioritised actions you can accept, assign or ignore. The decisions stay with you. Each summary sits beside the comments it summarises.

  • AI processing stays within the UK and EU.
  • Your data is not used to train third-party AI models.
  • Answers are pseudonymised, or anonymised where possible, before they are given to any AI tool.
  • Ten Space meets the requirements of the EU AI Act.

Our AI policy is the full statement: anonymised data may be used to train Ten Space's own models, but is never shared with third parties to train public or third-party models.

See AI insights for more.

Data protection and GDPR

Ten Space is GDPR compliant. A data processing agreement (DPA) is in place with every client, and it sets out how long your data is kept. Our DPA, sub-processor list and certificates are provided on request.

Data retention varies. Transient data, including logs, is kept for between 14 and 90 days depending on its specific nature. Records pertaining to surveys and employee performance are normally kept until 90 days after the end of your contract. Where required by law, certain data, such as that related to financial activities, may be retained for longer.

We work with our clients' nominated Data Protection Officer to respond to requests received under GDPR, such as Data Subject Access Requests and Right to be Forgotten requests, in a timely fashion.

Our DPA identifies that Ten Space is a Data Processor for the purposes of GDPR. The client is considered to be the Data Controller.

Where a client chooses to use WhatsApp, which is optional, Meta requires that the employer has obtained consent to receive communication over WhatsApp. This is often covered in general terms in employment contracts, but the client should confirm it before choosing to use WhatsApp.

Our ICO registration number is ZA773423.

Support and availability

Every client has a dedicated client success manager: a named UK-based expert who works alongside your team. Expert help, training and support are always included.

  • Support is available in UK office hours, 9am to 5pm on working days, through the support portal in the platform and by email.
  • A critical issue can be escalated at any hour.
  • We aim to respond to a critical issue within one hour, at any hour, and to any other issue within four business hours.
  • Ten Space has consistently averaged over 99.99% availability over the last three years and our standard contract includes an SLA. You can view our status here.

If your people are outside the UK

Ten Space is based in the UK and works with organisations wherever their people are. Your data is hosted in London wherever your people are, and AI processing stays within the UK and EU.

For legal reasons, additional restrictions may apply when sending messages such as emails, SMS or WhatsApp messages, to some countries.

Contracts are under the law of England and Wales, and charges are in pounds sterling.

Integrations

  • We can connect Ten Space to many HR systems and set it up with you.
  • We have an API that you can access.
  • You can upload or download your employee records and survey results directly as CSV files.

Our policies

Company details

  • Ten Space Tech Ltd, registered in England and Wales, company number 12455581.
  • Registered office: 7 St. Petersgate, Stockport, SK1 1EB.
  • ICO registration number: ZA773423.
  • VAT number: GB383408878.
  • Phone 0161 676 3443; email hello@tenspace.co.uk.

Updated 18 October 2026

Questions IT, legal and procurement teams ask

Where is our data hosted?

Your data is hosted in London wherever your people are, in a secure virtual private cloud (VPC) on AWS. AI processing stays within the UK and EU.

Is Ten Space GDPR compliant?

Yes. Ten Space is GDPR compliant and meets the requirements of the EU AI Act. Our DPA, sub-processor list and certificates are provided on request.

Is our data used to train AI models?

Your data is not used to train third-party AI models. Our AI policy is the full statement: anonymised data may be used to train Ten Space's own models, but is never shared with third parties to train public or third-party models.

Can our people sign in with single sign-on?

Yes. Authentication can be configured to require SSO through Google Workspace or Microsoft Entra ID. Alternatively, you can allow email address and password login, including enforcement of your own password policy.

How long do you keep our data?

Data retention varies. Transient data, including logs, is kept for between 14 and 90 days depending on its specific nature. Records pertaining to surveys and employee performance are normally kept until 90 days after the end of your contract. Where required by law, certain data, such as that related to financial activities, may be retained for longer.

Can we see your DPA, sub-processor list and certificates?

Yes. Our DPA, sub-processor list and certificates are provided on request.

See what your people would tell you.

or call 0161 676 3443

Sign up for our regular round up