Code of Conduct

How we work, what we protect, and how we escalate.

Our principles

1. Confidentiality first

We treat every piece of client information as confidential by default. We never disclose client names, project details, systems, or any sensitive information to anyone outside the engagement. When in doubt, we say nothing and ask.

2. Minimal footprint

We observe only what is necessary to do our work. We do not collect, copy, or retain more than the engagement requires, and we delete what we no longer need.

3. Honesty and directness

We tell clients what we see, including what is uncomfortable. We do not flatter, and we do not hide problems. We commit only to what we can deliver.

4. Respect for people

We treat every team member we work with, observe, or interview with respect and discretion. We never use information about an individual against them.

5. Independence

We give advice in the client's interest, free of any undisclosed conflict. We disclose any relationship that could bias our recommendations.

Observation methodology

Our work involves attending client meetings and interactions as observers. The purpose is to identify communication patterns, map the flow of briefs and responses, and locate points where information does not travel cleanly or accountability is lost. We observe the structure and quality of communication — not the content of specific projects, site details, or classified material.

In practice this means: we join sessions, we listen, and we produce anonymised written summaries afterward. Those summaries capture patterns and process observations only. Any project-specific content that is visible or audible during a session — for example, the subject matter of a brief or debrief — is neither recorded nor retained. We note only what can be described without reference to the underlying content: whether a brief was clear, whether it was understood, whether a response was timely, and where the communication broke down.

Where recording or local transcription tools are used, these are subject to the consent requirements and security controls set out in the Information Security Policy. Where automated processing tools are deployed on client infrastructure as part of the engagement, the terms of processing, data flows, and retention are governed by a separate Data Processing Agreement agreed in advance of any such deployment.

Escalation — what we do when something goes wrong

If any of the following occur, we act immediately and transparently:

1. A confidentiality breach (suspected or actual). We notify the client's designated contact within 24 hours, describe what happened, and propose containment steps in writing.
2. A data loss or security incident. We isolate the affected material, document the incident, and inform the client per the Information Security Policy.
3. A conflict of interest emerges mid-engagement. We disclose it in writing before continuing any affected work.
4. We are asked to do something outside the agreed scope or against this Code. We decline, explain why, and refer to Gregor Lederer as the escalation owner.
5. A welfare concern arises that directly affects the security of the engagement. We raise it privately and promptly with the client lead, never publicly and never beyond what the engagement requires.

This Code is a statement of principle. Specific legal obligations are set out in the signed Non-Disclosure Agreement, the Information Security Policy v2.1, and the Data Processing Agreement where applicable.