How we handle, store, and protect information entrusted to us.
We apply two tiers to all information received from or about a client.
Where there is any doubt as to the appropriate tier, we treat information as Restricted.
In the course of a collaboration we observe communication structure and patterns — timing, frequency, response flow, where conversations happen, and where things fall through. We may note phrases and observations that relate directly to the subject of our engagement.
The following are never recorded or stored in any form: client names, project names, system or site details, threat or risk specifics, commercial figures beyond what the client explicitly shares for the purpose of the engagement, and personal data beyond what is strictly necessary to describe a communication pattern.
Our specific observation methodology — including the security mechanisms applied during sessions and the alternative observation methods used where recording is not appropriate or consented to — is set out in the accompanying Code of Conduct, which forms part of the engagement agreement.
All observations are anonymised and summarised before being stored. Identifying details are removed at the point of note-taking. Where partial transcripts or raw notes exist transiently, they are deleted within 24 hours of producing a final anonymised summary. Anonymisation follows the principle of removing any detail that would allow re-identification of an individual or organisation by a reasonable third party.
The Director is the sole person with access to client material by default. Where any additional personnel are engaged on a project, they are subject to a signed confidentiality agreement before receiving access to any client information. Access is limited to what is strictly necessary for the task and revoked immediately on completion of that task or termination of the relationship.
Devices used for client work are locked when unattended and are not used in unsecured public environments where screen content may be observed. Devices are not left unattended in vehicles or public spaces. In the event of loss or theft of a device, the incident handling procedure in Section 10 applies immediately.
We do not record any meeting without the explicit, prior consent of every participant, obtained before recording begins. Where local transcription tools are used (such as faster-whisper or pyannote, which process audio on-device and do not transmit data externally), this is disclosed and consented to in advance. Any participant may decline recording or transcription, and we will not proceed without unanimous agreement.
AI tools — including but not limited to large language model assistants — are not used in any capacity in connection with client engagements. No client information, whether Restricted or Internal, is inputted into any AI tool. This prohibition is absolute and is not subject to client-by-client exceptions. Compliance is a condition of engagement for any personnel involved in a project.
The following tools may be used in the course of a collaboration. All tools listed below are agreed with the client prior to use where they will process client personal data, in accordance with Section 11.
No tools outside this list are used to process client data without prior written agreement with the client.
If a security incident occurs — including loss of a device, unauthorised access, or suspected disclosure of client information — we will: contain the incident immediately; notify the client's designated contact within 24 hours of becoming aware; provide a written account of what occurred, what data was involved, and what steps have been taken; and agree remediation and any required notifications in writing with the client. Where an incident involves personal data and meets the threshold under applicable law, we will notify the relevant supervisory authority as required.
We do not pass client information to any subcontractor or third-party tool without the client's prior written agreement. Where a tool processes client personal data, a Data Processing Agreement is in place before processing begins. The tools listed in Section 9 are disclosed to the client at the outset of the engagement; their use constitutes the client's agreement unless the client specifies otherwise in writing.
The client may request a review of any material we hold relating to their engagement at any time. On termination of the collaboration, or on the client's written request, we delete all client-related material within 14 days and provide written confirmation of deletion. Where legal or regulatory obligations require us to retain certain records beyond that period, we notify the client accordingly.