How we protect your data
We advise organisations on data protection, so we hold ourselves to the same standard. This page explains how we handle client and visitor information.
Confidentiality first
Everyone who works on client engagements signs a confidentiality and data protection undertaking. We are happy to sign your non disclosure agreement before any discussion.
Only what we need
We ask for the minimum information needed for an engagement. Assessments are carried out on your systems where possible, so your data stays with you.
Secure sharing
We never ask you to send personal data or confidential documents by ordinary email or through our website form. We agree an encrypted channel for each engagement.
Protected accounts and devices
Our accounts use multi factor authentication, devices are encrypted, and access to client material is limited to the people working on it.
Clear retention
Client working files are kept for the engagement and a limited period after it, then securely deleted, unless you ask us to return them sooner.
No selling, no tracking
We never sell data. This website sets no advertising or tracking cookies and loads its fonts from our own server.
Service providers we use
These providers process limited data on our behalf under their data processing terms.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website hosting, security and privacy friendly visitor statistics | Global network |
| GitHub | Website source code and content management | United States |
| Email service provider | Delivering website enquiries to our inbox | Confirmed on request |
Report a security issue
If you believe you have found a security vulnerability on this website, please tell us privately at [email protected] with the subject "Security report". Please do not access or change data that is not yours, and give us reasonable time to fix the issue before sharing it. Our security.txt file has the details.