Security Statement

1. Access control

• Least-privilege access: only the minimum access required.
• Strong authentication for administrative access.
• Separation of client environments where practical.

2. Data protection

• We limit collection of personal data to what is necessary.
• We store data securely and restrict access.
• We support secure transmission (HTTPS) for website traffic.

3. Monitoring and resilience

• We monitor availability and respond to incidents.
• We maintain backups and recovery procedures appropriate to the service level.
• We keep dependencies and systems updated as part of maintenance.

4. Incident response

If we become aware of a security incident affecting personal data, we will assess impact, contain the issue, and notify affected parties where required by law.

5. Client responsibilities

• Protect your own accounts with strong passwords and multi-factor authentication where available.
• Provide access credentials securely and revoke access for leavers promptly.
• Keep your devices and email accounts secure to reduce phishing risk.