Security
How we protect your information
Clients trust us with sensitive details about their systems. These are the commitments we work to.
- Least privilege: read-only access wherever possible, granted per engagement and removed at the end.
- Your systems, your evidence: audit evidence stays in your repositories or compliance platform, not on our devices.
- Contracts first: NDA and, where personal data is involved, a data-processing agreement before work starts.
- Strong authentication: multi-factor authentication on every account we use for your work.
- Encryption: encrypted devices and encrypted channels for any file exchange.
- Retention: working notes deleted or returned at the end of an engagement unless the contract says otherwise.
- Reporting a vulnerability: if you find a security issue on this website, please email us; we appreciate responsible disclosure.