Security & compliance
Security built into every engagement
Enterprise-grade security and compliance built into every solution. Your data protection is our top priority.
Our posture in one line
Least-privilege access, encryption in transit and at rest, isolated infrastructure, and written data-handling terms per engagement.
We will confirm any control you need in writing before you rely on it.
Security practices
Controls we apply
Security controls and operational procedures following industry best practice.
Data encryption
Data is encrypted at rest using AES-256 and in transit using TLS. Encryption keys are managed with automatic rotation.
Access controls
Role-based access control (RBAC) with the principle of least privilege. Multi-factor authentication is required for all administrative access.
Infrastructure security
Isolated networks, segmentation and DDoS protection, with regular security assessments and penetration testing.
Data privacy & residency
Your data stays yours
Data ownership
You retain full ownership of your data. We never use customer data to train AI models or share it with third parties without explicit consent.
Data residency
Choose where your data is stored: US, EU or other regions. Enterprise customers can request specific geographic data residency requirements.
Data retention
Configurable retention policies. Data can be deleted on request, with verification of complete removal within 30 days.
Data portability
Export your data at any time in standard formats. No lock-in, no proprietary formats.
Compliance-aware delivery
GDPR-aligned data handling, with HIPAA-ready architecture available for engagements that involve protected health information.
Microsoft tenant security
Deployments run inside your Microsoft tenant, so identity, access and audit trails stay under your control.
Incident response
Plan, monitor, respond
Detection & monitoring
We maintain monitoring and alerting on the systems we operate, with a documented incident response plan and a named owner for each engagement.
Response & communication
Incident notification, containment and remediation timelines are agreed in the contract before work starts, including the contact path and escalation route.
Compliance
Questions about security?
Ask before you buy
Our team will discuss your specific compliance and security requirements, complete your questionnaire, and provide current documentation for review.
[email protected] →Sending us a security questionnaire?
Send it with the date you need it back. We’ll answer every question and flag anything we can’t evidence.