Security.
We protect our clients' information under an information security policy based on the ISO/IEC 27000 standards. We are certified under the UK Government's Cyber Essentials scheme.
Certification.
Cyber Essentials
Certified under the UK Government's scheme for protecting organisations against common cyber attacks.
Cyber insurance
We hold our own cyber insurance, as well as the cover that comes with Cyber Essentials.
ISO/IEC 27001
Our policy follows the controls in this international standard.
AI for cyber defence
We've been approved to use AI models built for cyber defence, which only verified security teams can access. We use them to find and fix weaknesses in the systems we build and run.
What the policy covers.
Version 1.5, October 2026. We review it every year, and clients can ask for the full policy.
How we handle personal data is in our privacy notice. To report a security problem, use our contact page.
People
Everyone who works for us, including contractors, is bound by the policy through their contract, completes our security training and passes a test.
Access
People get access only to the systems their role needs, and lose it when they leave.
Devices and data
Rules for laptops, phones and remote working, encryption, and how we label and handle information.
Operations
Malware protection, tested backups, logging and monitoring, and managing vulnerabilities.
Development
Security is part of how we design, build and test systems, including how we handle test data.
Suppliers
Suppliers who handle information for us must meet the same standards.
Incidents
A set process for reporting and handling security incidents, and plans to keep working if something fails.
Start a conversation.
Whether you're starting something ambitious or restarting something that's lost momentum, we'd like to hear about it.