Data handling
Your data stays with you by default
In most engagements client data never leaves the client’s environment. We build, test and deploy inside your infrastructure, under your access controls and your policies.
When you need us to process it
Where an engagement requires us to take data over for processing, we do so only under a signed Data Processing Agreement, acting as your processor under the GDPR, and only for the purposes the agreement sets out.
Certifications
No ISO certifications, by choice
We do not hold ISO management-system certifications and have no plans to pursue them. Certification adds cost that our clients end up paying for. We prefer to be transparent about how we work and to answer your security and compliance questions directly.
What we offer instead
- Our policies, available for your review
- Completed security questionnaires on request
- Contractual commitments in the engagement agreement and DPA
AI Act alignment
We hold ourselves to the rules we advise on
Regulation (EU) 2024/1689 applies to us as a developer and user of AI systems, and to the systems we build for clients.
In our own work
- AI-assisted content on this site is disclosed and human-reviewed, as set out in our AI notice
- No AI system on this site profiles you or takes decisions about you
In what we build
- Every system is classified against the Act’s risk tiers at the start of an engagement
- Your role and ours, provider or deployer, is agreed in writing
- Documentation, logging and human-oversight measures are built in, not added later
On request
Documents procurement can request
Available to prospective and existing clients, usually under a non-disclosure agreement.
Data Processing Agreement
Our standard GDPR Article 28 terms, or review of yours.
Information security policy
How we protect systems, credentials and client data.
AI use policy
How we use AI internally and in client work.
Company registration extract
Official registry extract for due diligence.
Security questionnaire answers
We complete your questionnaire or share our standard responses.