Secure by design. Trusted by principle.
Everything your security, risk and procurement teams need to know about how we handle your information, in one place.
How we treat your information
Client discretion
We never publish who we protect. Case studies are anonymized, and references are shared privately with the client's permission.
Vendor-neutral advice
We work with many vendors so that our recommendation follows your requirements. The technology is named once we understand your needs.
Confidential by default
Details you share about your environment are used only for your engagement, and we are glad to put a non-disclosure agreement in place before technical discussions.
Data protection built in
Our own website collects only what it needs, stores it privately, deletes inactive enquiries after 3 months and gives you full rights over your data.
This website
The same controls we would expect from a client, applied to ourselves.
- Encrypted connections (HTTPS) across the whole site
- Enquiries stored outside the public web root, never published
- Staff-only dashboard with password protection and session limits
- IP addresses pseudonymised (salted hashes) in our application data
- Inactive enquiries deleted automatically after 3 months
- No advertising or analytics trackers on public pages
Found a vulnerability?
We welcome reports from researchers and publish a security.txt so you know where to send them.
Responsible disclosureVendor onboarding and due diligence
Onboarding us as a supplier? Tell us what your procurement or third-party risk process needs, from company documents to security questionnaires, and we will respond directly.
Request documentsRegulations we help you meet
Practical guides to the rules our clients answer to, and how each maps to controls.