FAQ
Questions worth asking before trust becomes infrastructure.
Straight answers to the questions that matter before someone trusts a new compliance system.
About the company
Who is behind Thesmios?
Thesmios is founded by Victor Humenhuk, a compliance and risk intelligence professional with experience building AI-powered risk profiles at LSEG.
Where are you based?
Thesmios is based in London and is focused first on UK regulated firms.
Are you regulated?
Thesmios is not itself a regulator. It is building compliance infrastructure for firms that operate under regimes such as FCA, SRA, and MLR supervision.
Footprinted
How does it work?
Footprinted scans public and consented sources, highlights findings, and gives users remediation actions before they share a verified profile.
What do you store?
We store account details, scan results, remediation status, and technical logs needed to provide the service.
Can I delete my data?
Yes. Users can request deletion of their account and report data, subject to limited legal and security records.
Will employers know?
No. Employers do not know you checked yourself unless you choose to share a profile or report with them.
The platform
When does it launch?
The Thesmios Platform is planned for 2026. The waitlist is open for early regulated firms.
What firms is it built for?
The first version is built for FCA, SRA, and MLR-supervised firms with roughly 50 to 500 employees.
How is it priced?
Pricing will depend on employee count, risk dimensions, monitoring scope, and whether external due diligence is included.
Compliance and ethics
Is this a social score?
No. Thesmios is purpose-specific compliance screening. It is not a generalised rating of people, and it is built around context, consent, and human review.
How do you handle the EU AI Act?
The product is positioned as lawful, purpose-specific compliance screening, not prohibited social scoring. Legal review will precede EU deployment.
What is your lawful basis?
Footprinted scans run on consent. B2B processing will use the appropriate lawful basis for each workflow, documented before launch.
Security
Where is data hosted?
The intended production architecture hosts core data in AWS London, eu-west-2.
What certifications do you have?
Cyber Essentials is targeted for Q3 2026, ISO 27001 for Q1 2027, and SOC 2 Type II for Q4 2027.
Who can access my data?
Access will be role-based, limited to authorised users, and logged for auditability.