Security and compliance
What your security and procurement teams will ask, answered up front. Request the full security pack for policies, reports and completed questionnaires.
Certifications and reports
- ISO/IEC 27001[Certified, valid until YYYY]
- SOC 2 Type II[Report under NDA]
- ISO 9001[Certified, valid until YYYY]
- Cyber Essentials Plus[UK, renewed YYYY]
- Penetration test[Annual, summary on request]
Data protection
- Data processing agreement for every client, under GDPR and UK GDPR
- International transfers covered by EU Standard Contractual Clauses and the UK International Data Transfer Addendum
- Business associate agreements for US healthcare work (HIPAA)
- Client data stays in your cloud accounts and region. We do not copy production data to our systems.
- Published list of subprocessors, with notice before any change
Secure development
- Peer review on every change, with branch protection in your repositories
- Static analysis, dependency scanning and secret scanning in CI
- Threat modelling for new features that touch sensitive data
- OWASP ASVS used as the baseline for web application security
- Software bill of materials on request
How we use AI coding tools
Buyers now ask this in every security review, so our policy is public.
- We use only enterprise AI tools with training on customer data turned off: [list of approved tools].
- A human engineer reviews and owns every AI-generated change before merge.
- AI-generated code goes through the same tests and security scans as other code.
- You can turn AI tools off for your project, or limit them to approved ones.
- We never paste client secrets or personal data into AI tools.
People and access
- Background checks for every employee, where local law allows
- NDAs and security training at onboarding and every year
- Single sign-on, multi-factor authentication and least-privilege access
- Managed, encrypted laptops with remote wipe
- Access removed within [24 hours] when someone leaves a project
Incident response
We notify you of a security incident that affects your data within [24 hours] of detection. That leaves you time to meet the 72-hour GDPR notification deadline.
Report a vulnerability through the contact form. See also our security.txt.
Send us your security questionnaire
We complete standard questionnaires such as SIG Lite and CAIQ, and we join calls with your security team.