CompanySecurity
Our own security posture.
We ask you to trust us with your systems, so this page says plainly where our own security stands. SOC 2 Type I is in progress. We will not describe it as anything stronger until the auditor does.
Where we stand
Stated, not implied.
- SOC 2
SOC 2 Type I in progress
We are being audited to the standard we recommend to you. We will say Type I is complete only when it is.
- Insurance
$5M professionally insured
Errors, omissions and cyber liability carried on every engagement.
- Target date for Type I
Targeting SOC 2 Type I by mid-2027
We would rather publish a date we might have to move than claim a certification we do not hold.
- Auditor
Not yet appointed
Vanta is our compliance platform.
Certifications held across the team
The credentials behind the advice.
Held by members of the team, not by the company.
- CISSP
- CISM
- CEH
- Security+
- A+
- AWS
- Cisco
- Ubiquiti
- Fortinet
What we run for you
Enterprise-grade tooling, licensed properly, deployed the same way for every client.
- Microsoft 365
- Microsoft Azure
- NinjaOne
- Huntress
- Defender for Business
- Duo
- Proofpoint
- KnowBe4
- Veeam
Incident process
If something goes wrong, you hear it from us first.
Within 1 hour of confirming an incident that affects your environment, we contact you. Not a status page, a person.
Every 12 hours after that, a written update, whether or not there is news.
Within 5 business days of resolution, a written post-incident report: what happened, what we did, what changes so it does not happen again.
We tell you when we are unsure. An incident we are still investigating gets reported as an incident we are still investigating.
How we run our own systems
Controls and policies.
- Controls
- Multi-factor authentication on every account.
- Least-privilege access, reviewed regularly.
- Encryption in transit and at rest.
- Endpoint protection on every company device.
- Centralised logging.
- Same-day access revocation when someone leaves.
- Written policies
- Our information security, access control, incident response and business continuity policies are being formalised through our SOC 2 programme. TODO_POLICIES_COMPLETE
You can request the current version at any point.
- Reporting a vulnerability
Send security concerns through the contact form. A person reads it.
Book a free IT audit.
No obligation and no pitch deck. We look at what you have, tell you what is wrong with it, and you decide what to do with that.
- A full inventory of your devices, accounts and licences
- A written list of the security gaps we find
- What your current setup is costing you against a flat per-user rate
Prefer to talk? Get in touch