Modern Slavery and Ethical Supply Statement

This statement is voluntary, and that matters

Section 54 of the Modern Slavery Act 2015 requires a slavery and human trafficking statement from commercial organisations that supply goods or services, carry on business in the UK, and have a total annual turnover of £36 million or more.

Innovology Ltd is nowhere near that threshold. SailCoach is free to use, we have no paid plans running, and our turnover is a tiny fraction of £36 million. The duty in s.54 does not apply to us. This statement is published voluntarily.

We are stating that plainly in the first paragraph for a reason. A small company that publishes a statement implying it is discharging a legal obligation it does not have is making a false statement in the course of trying to look responsible. If our turnover ever crosses the threshold, this becomes a statutory statement, will be approved and signed as the Act requires, and will say so here.

What follows describes our position as at 17 September 2026. It is short because our supply chain is short. A sprawling statement describing due diligence a two-person software company does not perform would be worse than a brief one that is true.

Our structure and our business

Innovology Ltd, trading as SailCoach, is registered in England and Wales. We build and run one thing: a sailing training and race-analysis platform, delivered over the internet at https://sailcoach.app.

We have no subsidiaries, no overseas establishments and no office. We manufacture nothing, ship nothing, warehouse nothing and sell no physical goods. We do not use labour agencies, gangmasters, recruitment intermediaries or outsourced workforce suppliers, and we do not engage seasonal or casual labour. Everyone who works on SailCoach is engaged directly and works remotely in the UK.

If any of that changes — in particular if we take on outsourced operational staff, or start selling branded clothing or equipment — this statement changes with it, and we say below why clothing specifically would be a material change.

Our supply chain

It has two parts and no third.

1. Cloud and software services. We rent computing capacity and buy software subscriptions. Every one of them is named, with what it does and what data reaches it, in our Subprocessor List — a hosting provider that runs all of our servers, an error-monitoring service, a transactional email service, an AI provider, an identity and speech provider, a weather data source, map tiles, video and asset hosts loaded by your browser, and source hosting, package and container registries. All of these are bought at list price on published online terms. There is no tender, no negotiation, and in most cases no human contact with the supplier at any point.

2. Hardware. A handful of laptops, phones and peripherals, bought at retail from mainstream manufacturers and retailers.

That is the whole of it. No merchandise, no printed materials, no events, no catering, no facilities contracts, no vehicles, no professional services beyond occasional accountancy and legal advice.

Where the risk actually sits

Being honest about this is the only part of the statement that adds value.

Not in our own operations

The realistic risk of forced labour, debt bondage or trafficking among a very small number of remote software workers in the UK is very low. We are not going to write paragraphs about screening our own workforce for indicators of exploitation as though that were the live issue. It is not, and pretending otherwise would devalue the parts of this statement that matter.

In the manufacture of the hardware we and our suppliers depend on

This is where the real exposure is, and it is not close.

Every laptop we write code on, and every server our code runs on, comes out of a supply chain that begins with mining — cobalt, tin, tantalum, tungsten, gold — and passes through component fabrication and assembly. Forced labour, bonded labour, child labour and state-imposed labour programmes are all documented risks at points in that chain, particularly in mineral extraction and in some regional assembly operations. We buy a small number of consumer devices and we rent capacity on machines somebody else bought, so we are several tiers removed from any of it, with no visibility and very little leverage.

In the construction and operation of data centres

Our hosting provider resells capacity in facilities we cannot name. We do not know which buildings our containers run in, who built them, or who cleans and guards them. That is a plain limit on what we can say, and no amount of policy language removes it.

The recognised risks in that layer are: construction labour, where recruitment-fee debt bondage, passport retention and migrant-worker exploitation are documented in several regions where hyperscale data-centre building is concentrated; and the facilities layer once a building is running, where outsourced cleaning, catering and security contracts are a recognised exploitation risk category in the UK as well as abroad.

One step further out

We use an AI provider for a small number of features, explained in our AI Policy. The wider industry that produces training data and content moderation for AI systems has well-documented labour-conditions problems. We do not buy data-labelling or moderation services ourselves, so this is not our supply chain — but it is adjacent to it, and we would rather mention it than have a reader notice the omission.

And, if we ever sell kit

Sailing clothing and equipment is a genuinely high-risk category: textiles and garment manufacturing carry some of the most consistently documented forced-labour risks anywhere. We do not sell any today. If we start, this statement will need a proper supplier due-diligence section rather than the one below, and we will write one before the first order, not after.

The steps we take

Proportionate, and described exactly as they are.

Supplier selection. When we choose a supplier, we look for a modern slavery statement, a supplier code of conduct or responsible-sourcing reporting. Where a supplier is large enough to fall under s.54 or an equivalent regime, we expect to find one. We have not until now kept a record of what we found, which means we cannot tell you today what share of our suppliers publish one. From this version of the statement we are keeping that record — including where we looked and found nothing, which is common for smaller cloud services and for suppliers outside the UK who are not caught by the Act — and the figure appears in the table below from 31 December 2026.

We rely on our suppliers' own programmes, and we say so. The practical position of a company our size is that our modern slavery controls over hardware and data centres are, almost entirely, the controls operated by much larger organisations further up the chain. We read what they publish. We do not audit them, we do not visit their sites, we do not commission assessments, and we could not meaningfully compel a change if we found one. Describing that reliance as "due diligence" would be an overstatement, so we are calling it what it is: reliance.

Hardware. We buy from manufacturers that publish conflict-minerals and responsible-sourcing reporting, and we keep devices until they fail rather than replacing them on a cycle. Buying fewer devices less often is the only lever we hold that genuinely reduces our exposure, and it is a small one.

Contract terms. Where we have a negotiated contract rather than click-through terms — which today is almost nowhere — we will include a requirement that the supplier complies with the Modern Slavery Act 2015 and permits us to raise concerns. We are not claiming we have done this across our supply chain, because we have not.

If a concern is raised

This is a written procedure we operate, not a product feature.

Anyone — a user, a club, a supplier, a member of the public, or anyone working with us — can raise a modern slavery concern by writing to [email protected] or [email protected]. You do not have to be sure. A suspicion is enough, and you will not be asked to investigate anything yourself.

What happens then:

1. We acknowledge it within five working days.
2. It is assessed at director level. There is no committee; there is one small company and a named person who owns it.
3. If anyone is in immediate danger, we call 999. For anything else involving a person at risk in the UK, we contact the Modern Slavery and Exploitation Helpline on 08000 121 700, which is confidential and available at any hour, and we follow their guidance. Where the concern involves a child, our Safeguarding Policy governs and takes precedence over everything in this document.
4. We raise the matter with the supplier concerned in writing and ask what they are doing about it.
5. We decide whether to continue buying from them. Withdrawing our custom is a small gesture, but it is the one sanction we actually hold, and we will use it where a supplier will not engage. We will not walk away silently from a situation where staying engaged does more good — that judgement will be recorded with reasons.
6. We record the report, the assessment, the action taken and the date in a register, and the count appears in the next version of this statement.

Nobody who raises a concern in good faith will suffer for it. That applies to anyone we work with, whether or not they are employed by us, and whether or not the concern turns out to be founded.

Policies that support this

• Our Code of Conduct sets the standard of behaviour we expect of everyone connected with SailCoach, including that no one is exploited, coerced or made to work against their will.
• Our Complaints Policy sets out how any concern is received, acknowledged and escalated, and what to do if you are not satisfied with our answer.
• Our Safeguarding Policy governs anything involving a child or an adult at risk, and overrides this document where the two overlap.

Training

We do not run a formal modern slavery training programme. A company of our size does not have one, and describing an e-learning module we have not bought would be exactly the kind of statement this document is trying not to be.

What we do instead:

• The person who makes purchasing decisions has read this statement, including the risk section, and reviews it when it is updated.
• Anyone who joins Innovology Ltd reads this statement as part of starting work, alongside the Code of Conduct.
• We review the statement annually, and the review is itself the refresher.

If we grow to the point of having a team, procurement of anything physical, or any outsourced operational staff, we will introduce proportionate training at that point and record it here.

How we will measure whether this is working

Four things we can actually count, published in each annual update:

One caveat on the first line, because it would be easy to misread. Zero reports is not evidence of zero risk. We have no workforce in the exposed parts of the chain, no audit programme and no presence in the countries where the risk is concentrated. Nobody working in a component plant has any route to us. A nil return tells you that nothing reached us; it does not tell you that nothing happened.

Review and approval

This statement describes our position as at 17 September 2026. It will be reviewed and republished at least annually, with the next review due by 17 September 2027, and sooner if our business, our suppliers or our turnover change materially.

It has been read and approved by a director of Innovology Ltd, which is registered in England and Wales. To be unambiguous about what that is and is not: because s.54 does not apply to us, this statement has not been through the formalities the Act requires — it has not been approved by a resolution of the board and it does not carry a director's signature. We are not claiming those steps, and nothing here should be read as a s.54 statement. If our turnover crosses the threshold, they happen and this section will say so.

Questions, corrections and challenges to anything in it go to [email protected].