Trust, Governance and How We Handle Your Data

Access we ask for, and access we do not

Security work requires access, and that access is exactly what makes a consultancy a risk to its clients. We keep it proportionate: read-only wherever read-only will do, scoped to the systems in the engagement, time-limited to the engagement period, and using named individual accounts rather than a shared credential.

You are entitled to know which of our consultants will hold access, to have that access revoked at any point, and to see a record of what was accessed. We ask clients to remove our access at the end of an engagement, and we will remind you if you have not.

• ✓Read-only access wherever the work permits it
• ✓Named individual accounts, never shared logins
• ✓Access scoped to the systems in the agreed engagement
• ✓Time-limited and revoked at engagement close
• ✓MFA enforced on every account we hold in your environment

Confidentiality and reporting

Reports describing your weaknesses are among the most sensitive documents your business will ever hold, and they are equally sensitive in our hands. They are stored encrypted, shared through a secure route rather than as email attachments, and never used as marketing material.

We publish case studies only with written client consent, and by default they are anonymised by sector and size. If you would prefer we never reference the engagement at all, that is the default position unless you tell us otherwise.

Commercial independence

We do not take commission from security product vendors. That matters because a recommendation is worth nothing if the recommender is paid by the outcome. Where we suggest a product we will tell you why, what the alternatives are, and whether something you already own would do the job.

Where an assessment finds that a client needs less than they are currently buying, we say so, including where that reduces our own revenue.