TRUST / SECURITY
How we secure our business
We run the same protections for our own business that we recommend to clients. Here's what's in place today.
Last reviewed:
Accounts and access
Multi-factor authentication on every company account
A password alone is never enough to get in.
A password manager for all staff
Unique, strong passwords for every system, with no shared or reused passwords.
Least-privilege access with regular reviews
People only get access to what their role needs. We review access regularly and remove it when it's no longer needed.
Devices
Endpoint detection and response on every company device
Software that watches for suspicious activity and stops it.
Encrypted, centrally managed devices
Company laptops and phones are encrypted, so a lost device doesn't expose data. They're managed centrally so we can update, lock, or wipe them.
Data and recovery
Encrypted backups, tested regularly
We confirm our backups actually restore.
Finding weaknesses
Daily vulnerability scanning
Our environment is scanned every day, so issues are found and fixed quickly.
People
Background checks for staff
Completed before anyone is given access.
Security training every year
Every staff member completes security training at least once a year.
When something goes wrong
A written incident response plan
It defines who does what, how we contain and recover, and how we notify affected clients.
Client notification within 72 hours
If we confirm an incident affecting a client's data, we notify them within 72 hours of confirmation, or sooner if their contract or the law requires.
Need documents or answers for a security review?
Request informationLet's look at your business together.
A 30-minute call. No cost, no pressure, and honest answers.