How we look after the data you trust us with

Every person has a named account with role-based, least-privilege permissions. Multi-factor authentication is enforced on all critical systems and single sign-on is used wherever a platform supports it. Administrator rights sit with a small number of named people, never on shared accounts, and are reviewed against a privileged access register.

Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256 inside the platforms we use. Every company laptop has full-disk encryption enforced centrally, and client data is never kept on removable media.

Laptops are enrolled in Jamf device management with endpoint detection and response, DNS filtering and enforced screen lock. Security patches are pushed automatically, and a lost or stolen device is locked or wiped within 24 hours of being reported.

Our IT partner, DARE, runs ongoing vulnerability assessments and penetration testing across our corporate estate and applications, with no open findings. Staff face phishing simulations every year, and our domain is protected by SPF, DKIM, DMARC and Google Workspace data loss prevention.

Google Workspace is backed up daily by CloudAlly with point-in-time restore. CRM and project data are protected by HubSpot and ClickUp platform backups, and all source code is version controlled in private GitHub repositories. Continuity plans are tested every year: the June 2026 exercise restored service after a simulated HubSpot outage in under three hours.

Every security event is logged, investigated and closed out against an incident register, with lessons fed back into the risk assessment. If personal data is involved we assess the risk to individuals, report notifiable breaches to the ICO within 72 hours and tell affected clients without undue delay.

Every hire is reference checked, with basic DBS checks where a role needs one. New starters complete security training before they get system access, everyone refreshes it every year, and everyone signs a confidentiality agreement. Access and equipment are recovered on the day someone leaves.

Suppliers are ranked by how critical they are to client delivery and checked before onboarding, including their certifications and data processing terms. Data processing agreements are in place with every sub-processor, and transfers outside the UK and EEA rely on adequacy decisions or Standard Contractual Clauses.

The CEO is accountable for the management system. Information security is a standing item at the weekly management meeting, risks are assessed and treated on a defined method, and an internal audit and formal management review run every year ahead of the external audit.

Our Manchester office is open to staff only, through keypad entry with an individual code per person. Physical security is risk assessed every year. We hold no paper records: client information lives in managed cloud platforms, and retired equipment is securely wiped before disposal.