Data Security & Privacy

We access client systems only where required to deliver a scoped engagement, using the minimum level of access necessary. Client credentials and API keys are stored in a dedicated, encrypted password manager — never in documents, email, or messaging tools. Access is granted to named team members only and is revoked at the conclusion of an engagement.

Data exchanged between systems is protected using industry-standard encryption (TLS/SSL). We build on established, reputable platforms that maintain their own recognized security and compliance certifications.

Where an engagement uses AI tools, we operate under enterprise and API-tier agreements that do not permit client data to be used to train third-party models. We define, with each client, the categories of sensitive data that are excluded from automated processing unless explicitly authorized in writing.

We maintain awareness of the platforms that client data passes through during an engagement and can provide clients with a current list of these tools on request.

At the conclusion of an engagement, client data in our possession is returned or securely deleted according to the client's instruction, and confirmed in writing.

In the event of a suspected security incident affecting client data, we will notify the affected client promptly and work directly with them to contain and resolve the issue.

We recognize that many clients operate under their own regulatory or contractual obligations. During onboarding, we document any client-specific security requirements and incorporate them into the terms of the engagement.