45 AI tools and adviser platforms, organised by use case. Each listing links to the provider's official website. Listings are not endorsements; please check terms and data handling before use.
Mortgage AI is for mortgage and protection professionals.
We haven't tested every tool. If you use an AI tool in your work, especially with client data, you remain responsible for your FCA obligations, such as the Consumer Duty and SM&CR, and for your data protection obligations under UK GDPR. Check with your network or compliance team before you start.
Some links are affiliate links. If you sign up through them we may earn a commission, at no extra cost to you. It never affects what we write.
No tools match your search. Try another name or task, or clear the search.
Fact-find and meeting notes
Record, transcribe and summarise client meetings so notes are ready for your fact-find.
Yes, in the Terms of Service; confirmed by Otter by email, 20 Oct 2026. Source: Otter terms of service
Is your data used to train AI models?
Yes. Otter trains its own models on de-identified recordings and transcripts. Opt-out is available on Enterprise only; other plans cannot opt out (confirmed by Otter by email, 20 Oct 2026). Third-party AI providers do not train on the data. Source: Otter privacy and security page
Which security certifications are held?
SOC 2 Type 2. ISO 27001 not held; Otter says it is working towards it, with no date given (confirmed by Otter by email, 20 Oct 2026). Source: Otter privacy and security page
How long is data kept, and can you delete it?
Customers can delete recordings and transcripts manually. Custom retention policies are Enterprise only (confirmed by Otter by email, 20 Oct 2026). Source: Otter help: data security and privacy policies
AI notetaker that joins video calls to transcribe, summarise and make meetings searchable.
fireflies.ai
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Stored and processed in the US by default. Enterprise private storage can be in the EU; processing stays in the US. Transfers under the EU-US Data Privacy Framework and UK Extension, with SCCs and the UK IDTA as fallback. Source: Fireflies guide: data storage and transfer
No. Fireflies states customer data is never used for AI training and its AI vendors are contractually barred from doing so. Opt-out: not needed. Source: Fireflies guide: secure meeting notes
Yes, public DPA, which UK and EU users can sign. Source: Fathom DPA
Is your data used to train AI models?
Yes by default: de-identified customer data is used to improve Fathom's own models. Opt-out per user, or for the whole organisation on Team Edition. AI sub-processors are barred from training. Source: Fathom help: security and privacy
AI notepad that combines your own notes with a meeting transcript to write up the meeting.
www.granola.ai
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
No UK or EU hosting. All data is stored on AWS in the US (confirmed by Granola by email, 20 Oct 2026). UK entity: Granola Labs Ltd. DPA includes UK and EU SCCs. Sources: Granola help: security and data FAQs · Granola DPA
Yes by default on Free and Business plans, using anonymised data. On Business each user opts out individually; an organisation-wide opt-out is on Enterprise only, where workspaces are opted out by default. Granola cannot guarantee anonymised data was not used before a user opted out (confirmed by Granola by email, 20 Oct 2026). Third parties are barred from training. Source: Granola help: model training
Notes and transcripts are kept until deleted. Each user can set transcript auto-deletion from 1 day to 1 year. Enterprise admins can set a workspace retention policy. Users can export data or delete their account and all data (confirmed by Granola by email, 20 Oct 2026). Source: Granola help: transcript auto deletion
AI assistant for UK financial and mortgage advisers that writes meeting notes and file notes, drafts advice documents and completes forms from client records. Free plan for 10 meetings; paid plans from £99 per adviser a month plus VAT.
www.marloo.com/uk
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
UK customer data is stored in London (Supabase on AWS London), with daily encrypted backups also in London. Meeting capture (Recall AI), transcription (AssemblyAI) and AI processing (Anthropic and OpenAI) run in Europe; Marloo says this relies on UK adequacy regulations for EEA transfers. Marloo acts as processor; the firm is controller. Sources: Marloo blog: evaluating third-party tools · Marloo privacy policy
SOC 2 Type 2, according to Marloo; the report is available under NDA on request. Marloo also reports two independent penetration tests (October 2025 and April 2026). ISO 27001: not published, ask the provider. Source: Marloo blog: evaluating third-party tools
How long is data kept, and can you delete it?
Recordings, transcripts, summaries and file notes are kept while the account is active unless you delete them. When an account ends you can ask for deletion or export; working copies are deleted and one encrypted backup is kept for up to seven years unless you ask for a shorter hold. Meeting audio is deleted by the capture and transcription providers after processing. Source: Marloo blog: evaluating third-party tools
AI meeting assistant for UK advice firms that writes meeting notes, letters and reports in your firm's templates. Now available inside Twenty7tec's ADVICE CRM.
www.plannerpal.co.uk
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
AI assistant for UK advice firms that writes meeting notes, fills fact-finds and drafts suitability reports for you to review. Connects with Curo, Intelliflo, Xplan and Plannr.
advisoryai.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Primary hosting in AWS London, with backups and some AI processing in Ireland. Source: AdvisoryAI security page
CRM for UK mortgage and protection advisers with AI suitability letter drafting and compliance checks.
www.adviseriq.co.uk
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
UK. Customer data and backups in AWS London; AI via AWS Bedrock in the UK/EEA. Call transcription sub-processor (Deepgram) in the US under SCCs and the UK Addendum. Adviser IQ says the transcription model sits with the communications provider (confirmed by Adviser IQ by email, 20 Oct 2026). Source: Adviser IQ sub-processors
Is a data processing agreement (DPA) offered?
Yes, public DPA: 30 days' notice of sub-processor changes; return and deletion within 90 days. Breach notification aim: 48 hours (confirmed by Adviser IQ by email, 20 Oct 2026). Source: Adviser IQ DPA
Is your data used to train AI models?
No. AWS Bedrock: no retention and no model training. Opt-out: not needed. Source: Adviser IQ security page
Which security certifications are held?
Cyber Essentials (certificate number published). SOC 2, ISO 27001 and Cyber Essentials Plus are planned, with no timeline given (confirmed by Adviser IQ by email, 20 Oct 2026). The website footer says "ISO 27001 aligned"; no ISO 27001 certificate is published. Source: Adviser IQ security page
How long is data kept, and can you delete it?
Data returned or deleted within 90 days of termination; 30-day rolling backups. Source: Adviser IQ DPA
UK mortgage and protection case management with AI document analysis and suitability note drafting.
www.cleera.co.uk
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Primary database (Neon) in London; hosting and file storage on Vercel's global network. AI via OpenRouter and OpenAI in the US under SCCs and the UK IDTA, using zero-retention hosts only. Source: Cleera DPA
Is a data processing agreement (DPA) offered?
Yes, public DPA with named sub-processors. Source: Cleera DPA
Is your data used to train AI models?
No. Requests go only to zero-data-retention hosts and are not sent if none is available. Opt-out: not needed. Source: Cleera DPA
Which security certifications are held?
None of its own published; refers to its sub-processors' SOC 2 reports. Source: Cleera DPA
How long is data kept, and can you delete it?
Return or deletion on termination, subject to FCA SYSC 9 record keeping. Call audio deleted from the transcription provider within 24 hours. Source: Cleera DPA
AI software suite for UK advisers covering lead capture, meetings, criteria and case management.
www.mortgageaitoolkit.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Not published: ask the provider. The privacy policy says data may be processed in the UK, EEA or elsewhere with safeguards such as adequacy or SCCs. Source: Mortgage AI Toolkit privacy policy
AI CRM for UK mortgage advisers that turns calls into fact-finds, checks client documents and drafts suitability reports for adviser sign-off.
www.jammjar.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Core application data is hosted in the UK. Selected providers may process data in the UK, EEA or other approved locations, with safeguards such as the UK IDTA or UK Addendum. Sources: JammJar homepage · JammJar privacy policy
Is a data processing agreement (DPA) offered?
The privacy policy says processing is governed by contracts and data processing agreements with customers. JammJar acts as processor. Source: JammJar privacy policy
Is your data used to train AI models?
No. JammJar says it does not use customer personal data to train public or general-purpose AI models. Sources: JammJar homepage · JammJar privacy policy
Which security certifications are held?
ISO 27001: Not published: ask the provider. Source: JammJar homepage
How long is data kept, and can you delete it?
Set by the customer's documented instructions. On exit, data is returned, retained or securely deleted as instructed; backups may remain for a limited period. Source: JammJar privacy policy
AI that fills lender DIPs and applications from your fact-find and returns each one to you for review before you submit. Launching in beta from September 2026.
www.finova.tech/products/broker-hub
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Finova says Broker Hub data is hosted and processed in the UK. Source: Finova page: broker hub
General-purpose AI assistant from OpenAI for drafting, summarising and research.
chatgpt.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Business and Enterprise: EU data storage and inference residency available; UK storage residency for eligible Enterprise, Edu and API customers. Consumer plans: not offered. Source: OpenAI help: data residency
Consumer plans (Free, Pro, Max): a setting controls whether chats are used for training, with an opt-out. Team and Enterprise: no by default. Source: Anthropic privacy centre: model training
AI assistant built into Outlook, Word, Excel, PowerPoint and Teams. For advisers it can summarise long client email threads and draft replies in Outlook, recap Teams meetings with action items, summarise fact-find or meeting notes in Word, and analyse and chart spreadsheets in Excel. You check everything before it goes to a client.
Agents you can build: Copilot agents, including Microsoft's pre-built Researcher and Analyst agents, plus your own agents made with Agent Builder or Copilot Studio. Copilot Studio is included for licensed users building internal agents; a separate Copilot Studio licence is needed to publish agents to websites or apps.
Example adviser agents: A criteria Q&A agent that answers from lender criteria files stored in SharePoint. A document checklist agent that turns Teams meeting notes into a list of documents to request from the client. A case update agent that drafts client progress emails in Outlook for you to check.
UK pricing: Paid yearly, excluding VAT: Microsoft 365 Copilot Business add-on £16.10 per user a month (offered at £13.80 for the first year to eligible existing customers, 1 July to 31 December 2026). Microsoft 365 Business Standard with Copilot £18.10 and Business Premium with Copilot £24.60 per user a month. Some advanced features are billed by usage.
www.microsoft.com/en-gb/microsoft-365/copilot
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Google's AI assistant, built into Google Workspace. For advisers it can find, summarise and draft client emails in Gmail, take and summarise notes in Meet, help draft and polish documents such as marketing copy in Docs, analyse data in Sheets and summarise files in Drive. You check everything before it goes to a client.
Agents you can build: Gems: saved, custom versions of Gemini with your own instructions and knowledge files, usable in the Gemini app and the Gemini side panel in Workspace. Workspace Studio: AI agents that automate work across Workspace.
Example adviser agents: A criteria Q&A Gem that answers from lender criteria documents you add as knowledge files. A document checklist Gem that turns your meeting notes into a list of documents to request from the client. A marketing drafts Gem that follows your firm's tone and approval rules.
UK pricing: Google Workspace, billed monthly, excluding tax: Business Starter £5.90, Business Standard £11.80, Business Plus £18.40 per user a month. Starter includes Gemini in Gmail and the Gemini app; Gemini in Docs, Sheets, Meet and more starts at Standard. Introductory discounts may apply.
workspace.google.com/intl/en_uk/solutions/ai
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Google Workspace: set by your admin controls. Specific retention periods for Gemini prompts and responses: not published, ask the provider. Source: Google Workspace help: Gemini privacy
No. Email content is not used for training, and AI sub-processors are barred from training on it. Opt-out: not needed. Source: Superhuman help: AI overview
Depends on the feature. Client-specific models may be trained on that client's redacted data; shared learning uses redacted vectors; generative AI prompts are not used to train foundation models. Opt-out: not published, ask the provider. Source: Recordsure security and data page
Automated compliance and case file review for networks and lenders.
www.curvestone.io
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Hosted on Microsoft Azure in the region the client chooses, EU by default or US on request. Sub-processors (Microsoft, Google Cloud, AWS) are listed as UK/EEA. Sources: Curvestone page: trust · Curvestone sub-processors
Is a data processing agreement (DPA) offered?
Yes. A standard DPA is listed in the Trust Centre and shared on request. Source: Curvestone page: trust
Is your data used to train AI models?
No. Curvestone says model training is disabled across every AI provider it uses. Source: Curvestone sub-processors
Which security certifications are held?
ISO 27001:2022 and ISO/IEC 42001:2023 (certificate 19087, ISOQAR). Annual CREST penetration testing. Source: Curvestone page: trust
Teams, Business and Enterprise: content not used for AI training. Free and individual accounts: controlled by a privacy setting. Source: Canva help: privacy settings
AI platform for writing marketing content, such as web pages, emails and social posts, from prompts and templates.
www.copy.ai
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Copy.ai says it stores and processes data in the United States and European Union, and may transfer data to other countries. For UK data it says it uses the EU-U.S. Data Privacy Framework (UK extension) and standard contractual clauses. Source: Copy.ai privacy notice
No. Copy.ai's security page says "we don't train on your data". Source: Copy.ai security page
Which security certifications are held?
SOC 2, according to Copy.ai; the report is available on request. ISO 27001: not published, ask the provider. Source: Copy.ai security page
How long is data kept, and can you delete it?
Copy.ai says it keeps different types of personal data for different periods depending on the purpose. Specific periods are not published: ask the provider. Source: Copy.ai privacy notice
Visual automation platform for building multi-step workflows between apps.
www.make.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
EU data zones available. Some AI features route to the US or UK, and connecting your own AI provider is outside that zone. Source: Make help: AI providers and data zones
AI workspace that builds task lists, projects and workflows, with AI agents and automations.
www.taskade.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Taskade says its primary hosting is Amazon AWS in a single US East region. AI requests go to the model provider you choose, and Taskade says some providers are outside the US, the EU and the UK, including in China. Sources: Taskade security page · Taskade privacy policy
Is a data processing agreement (DPA) offered?
No. Taskade says it does not currently offer customers a signed Data Processing Agreement, Standard Contractual Clauses or a UK transfer addendum. Sources: Taskade security page · Taskade privacy policy
Is your data used to train AI models?
Taskade says its contracts bar AI providers from using your content to train their general models, and that it does not use your data to train generalised AI models. Sources: Taskade security page · Taskade privacy policy
Which security certifications are held?
None held, according to Taskade. It says SOC 2 Type II and ISO 27001 certification are both in progress, with no SOC 2 audit report yet. Source: Taskade security page
How long is data kept, and can you delete it?
Workspace content is kept until you delete it or close your account. Taskade aims to remove account information within 30 days of account deletion and keeps AI interaction logs for normally no more than 30 days. Copies can remain in encrypted backups until they age out. Source: Taskade privacy policy
Desktop tool that records a process as you carry it out and turns it into process maps and step-by-step documentation. UiPath recommends its Task Mining product for new projects.
www.uipath.com/product/task-capture
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
UiPath's trust page links to a SOC 2 Type 1 report announcement for UiPath Automation Cloud. Certifications specific to Task Capture: not published, ask the provider. Source: UiPath trust and security
How long is data kept, and can you delete it?
UiPath's trust page offers a form for data deletion requests. Retention periods for Task Capture: not published, ask the provider. Source: UiPath trust and security
AI teammates, called Bots, that each work on their own persistent cloud computer, use your apps and websites, run tasks in parallel and come back when your approval is needed.
x.ai/bot
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Not published: ask the provider. Grok Bot says your cloud computer is encrypted in transit and at rest. Source: Grok Bot product page
Is a data processing agreement (DPA) offered?
The Grok Bot Terms list a data processing addendum as part of the customer agreement. Ask the provider for a copy. Source: Grok Bot terms
Files, browser sessions, credentials and memory are kept in a persistent cloud environment. Deleting a Bot may not delete shared data; you are responsible for removing it. Source: Grok Bot terms
Protection and insurance technology, including comparison and quoting tools for UK advisers.
uk.ipipeline.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Not published: ask the provider. The privacy notice refers to transfer safeguards. Source: iPipeline privacy notice
Is a data processing agreement (DPA) offered?
Not published: ask the provider.
Is your data used to train AI models?
Not published: ask the provider.
Which security certifications are held?
Not published for UK products: ask the provider. An ISO 27001-based security programme is described for the AlphaTrust e-signature product only. Source: iPipeline e-sign compliance PDF
Formerly Health Hub. Clients complete protection health and lifestyle disclosures online before the fact-find, and AI triages them against UK underwriter criteria.
formstart.com
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
FormStart processes questionnaire data on behalf of partner firms, which are the data controllers. DPA: ask the provider. Source: FormStart privacy policy
Is your data used to train AI models?
Only if the client opts in, anonymised data is sent to a third-party AI provider, which FormStart says does not train on or retain it beyond processing. Source: FormStart privacy policy
Conversational AI that guides advisers through medical and lifestyle disclosures and gives early indications of likely protection underwriting outcomes. Available through Iress's The Exchange.
interestinglife.co.uk/isla
Last checked: October 2026
Questions to ask the provider
Where is client data hosted, and is it transferred outside the UK?
Kept within UK-based Google Cloud infrastructure, encrypted in transit and at rest. Source: ISLA page: isla
Every hour spent on admin is an hour away from what advisers do best: talking to customers and protecting them. These are the 18 stages where AI can take on routine work, from the first email to protection, annual reviews and later customer touchpoints, with you checking anything that matters before it goes out.
1
Email triage and replies
Sort the inbox by urgency and draft replies for you to check and send.
Prepare birthday messages, moving-in day, home anniversaries and similar touchpoints that keep the adviser's brand in front of customers in a subtle, positive way.
We haven't tested every tool. If you use an AI tool in your work, especially with client data, you remain responsible for your FCA obligations, such as the Consumer Duty and SM&CR, and for your data protection obligations under UK GDPR. Check with your network or compliance team before you start.
Tools are listed as examples to explore, not endorsements. No tool here is approved by the FCA, and results vary by firm, so check each provider's terms and data handling before using it with client information.
Some links are affiliate links. If you sign up through them we may earn a commission, at no extra cost to you. It never affects what we write.
What should we build next?
We are building tools for mortgage and protection advisers and want to start where the day is busiest. Tick any you would like us to build.
We haven't tested every tool. If you use an AI tool in your work, especially with client data, you remain responsible for your FCA obligations, such as the Consumer Duty and SM&CR, and for your data protection obligations under UK GDPR. Check with your network or compliance team before you start.
Last checked: October 2026. Spot something wrong about your product? Email us and we'll look into it as quickly as we can. Email mortgageai@agentmail.to.
Questions to ask before you use an AI tool with client data. What we found in each provider's published information is a starting point for your own checks, not a compliance sign-off. The FCA does not approve or endorse software. Under each tool, "Questions to ask the provider" shows what the provider publishes, checked 20 Oct 2026; where nothing is published we say "Not published: ask the provider". See Questions to ask before using an AI tool: UK GDPR and FCA.
