Our commitment
Clients trust us with the systems that run their operations. We protect those systems and the data in them with layered controls across people, process and technology.
Access control
Access follows the principle of least privilege. Users are given only the permissions their role requires, administrative access is restricted and logged, and multi-factor authentication is used for privileged accounts. Access is reviewed regularly and removed promptly when people leave.
Encryption
Data is encrypted in transit using current TLS standards and encrypted at rest on hosted systems. Credentials and secrets are stored in protected configuration, never in source code.
Hosting and infrastructure
Hosted systems run on reputable infrastructure with network segregation, firewalls and timely security patching. Production environments are separated from development and testing.
Backups and recovery
Hosted systems are backed up daily, backups are stored separately from production, and restores are tested on a schedule so systems can be recovered after a failure or attack.
Monitoring and logging
We monitor availability and security events and keep activity logs that support investigation. Unusual activity is reviewed and escalated.
Secure development
Code is reviewed before release, dependencies are kept up to date, and changes are tested in non-production environments first. Client data is not used for testing without agreement.
Our people
Staff with access to client systems are bound by confidentiality obligations and receive regular security awareness training, including phishing and fraud awareness.
Incident response
We maintain an incident response plan. If an incident affects client data, we notify the affected client without undue delay and support any notifications required under applicable data protection laws.
Reporting a vulnerability
If you believe you have found a security weakness in this website or a system we operate, please tell us through the contact page, with enough detail to reproduce it. Do not access, change or delete data that is not yours. We will acknowledge your report and keep you informed.