Security and data handling

Security isn't a feature we add at the end — it's built into every network, system, and application from the first decision. This page explains how that applies to working with us and to your data.

Security by design

Every solution we deliver is designed with sound security practice from the start:

• Least privilege — people and systems get only the access they actually need, nothing more.
• Defence in depth — we don't rely on a single control; network, application, and access layers each do their part.
• Secure defaults — encryption in transit (and at rest where appropriate), hardened configurations, and patching as standard rather than optional.

How we handle credentials and access

• We ask only for the access a given task requires. If a request looks over-scoped, we'll explain why it's needed or find a narrower path.
• Secrets are never shared in plain text over email or chat. We use a secure method to exchange credentials and keys.
• Where possible we use your identity systems and per-person accounts rather than shared logins, so access is auditable and easy to revoke.
• When an engagement ends, access is handed back to you and our access is removed.

Your data

• You own your data. We process it to do the work you've engaged us for, and for nothing else.
• We minimise the data we hold to what's necessary, and we don't keep copies beyond what a project requires.
• Where your industry carries specific obligations (for example healthcare or financial data), we work to the controls your compliance context demands and can support audits and reviews.

Building secure systems for you

Beyond how we operate, security is part of what we deliver — firewalls, endpoint protection, access control, audits, vulnerability assessments, and penetration testing. You can read more on the cybersecurity service page.

Security is built into the network, application, and integration from the first line of code — never bolted on afterward.

Reporting a concern

If you ever spot something that looks like a security issue — in your systems or in how we're working — tell us immediately via your engagement contact or the contact form. Security reports are triaged as critical.