Security, data and compliance
What we commit to when we handle your data and build your systems.
Your data stays yours
We process client data only to deliver the work you have engaged us for. We do not resell it, mine it, or use it to build anything for anyone else.
Access is limited to the people delivering your project and revoked when they roll off or leave.
AI providers and your data
Where a system we build uses a large language model, we work with established providers through their commercial APIs, under terms that exclude your data from model training.
We will tell you which providers a given system depends on before you commit to it, not after. If a provider’s terms are a problem for your industry, that is a design constraint we work within.
Where your data lives
Data residency is a design decision we take with you at the start of a project, not a default we apply to everyone. Where your data sits depends on the systems it has to integrate with, the regulation you operate under, and what you need to be able to prove to your own customers.
If you have a residency requirement, raise it on the first call; it shapes architecture, and it is far cheaper to design for than to retrofit.
Contracts and subprocessors
Data processing agreement
We have a DPA ready to sign and expect to sign one on any engagement involving personal data.
Subprocessors
We maintain a current list of the subprocessors we rely on, available on request, so you can run your own assessment rather than take our word for it.
When something goes wrong
We maintain a documented incident-response process covering how an incident is identified, contained, escalated and communicated to affected clients. It exists before it is needed, which is the only time it is worth anything.
The process itself is shared under NDA as part of a security review.
Insurance
We carry professional indemnity and cyber liability cover. Certificates and cover details are available for your procurement team on request.
GDPR
We are a European company, so GDPR is not a module we bolted on for export; it is the regime we have always built under. Data minimisation, lawful basis and subject-access handling are part of how systems get designed here, not a compliance review at the end.
Running a vendor assessment?
Send us your security questionnaire. We would rather answer it properly up front than discover a blocker three weeks into a project.
