Trust

Security and compliance practices

How we access, change and look after the systems and data our clients trust us with. Written for the people who will review us before we start.

Access control

The minimum access needed, for the shortest time, on your terms.

Least privilege by default: Engineers receive only the access a task needs, scoped to named environments and removed when the engagement ends.
Client-managed identity: Where possible we use your SSO and IAM roles, so you keep the audit trail and the off-switch.
Multi-factor authentication: Required on every company system and every client system we use.
Access reviews: Reviewed [frequency] and whenever team membership or engagement scope changes.

Every change is reviewed, recorded and reversible.

Everything as code: Infrastructure and application changes are made in version control through pull requests.
Second-engineer review: No change reaches production without review by another engineer. Production approvals follow your change process.
Separated environments: Development, staging and production run in separate accounts with separate access.
Planned rollback: Each production change has a documented way back.

Logs that can't be quietly edited, kept as long as you need them.

Centralised, tamper-resistant logs: Cloud and application audit logs go to a separate log-archive account with write-once retention.
Retention set to your obligations: Retention periods follow your regulatory and contractual requirements, not platform defaults.
Owned alerts: Every alert links to a runbook and has a named owner.

A written process with a named incident lead. Where we operate inside your environment, we follow your incident procedure and escalation contacts.

Your data stays in your environment wherever possible.

Work in client environments: We don't copy production data to our own systems.
Encryption: Encrypted in transit and at rest, with key policies documented and owned by you.
Non-production data: Synthetic or masked data outside production.
Managed devices: Company laptops are centrally managed, encrypted and can be wiped remotely.
Offboarding: At the end of an engagement we remove our access and confirm in writing that working copies have been deleted.

We can share our information security policy, [sub-processor list] and completed security questionnaires under NDA.

If you believe you've found a security issue in our systems, email us. We'll acknowledge it and keep you updated.