Only approved software applications are permitted for use within the organisation. Software deployment, management, and patching are centrally controlled through our software management processes, ensuring that all authorised applications remain secure and up to date.

All software is appropriately packaged, tested, and released in line with defined change management procedures. Operating systems are fully supported and regularly patched to address security vulnerabilities and maintain system integrity.

We utilise Windows 11 desktops and laptops, with security and operating system updates applied automatically to ensure ongoing protection and compliance.

Sensitive or confidential information is not stored on systems that do not meet our security, compliance, and configuration standards, helping to safeguard personal and business data from unauthorised access or loss.

Our network infrastructure is subject to regular monitoring and review to identify and address any deviations from established security standards and data loss prevention controls. This enables us to detect potential risks promptly and maintain compliance with our information security requirements.

In addition, regular penetration testing is conducted at both the network and application levels to assess the effectiveness of our security controls and identify potential vulnerabilities. Findings are reviewed and remediated as part of our ongoing commitment to maintaining a secure and resilient technology environment.

Alternative (if no data ever leaves the EU/UK):

We utilise secure cloud-based services for the processing and storage of personal data, with security controls that are regularly monitored, reviewed, and tested. Our CRM system operates on a secure cloud infrastructure, ensuring resilience, availability, and data protection.

All personal data is hosted within the EU or UK, and no personal data is transferred outside the European Economic Area (EEA). This approach helps ensure compliance with GDPR and maintains a high standard of data security and governance.

Applications that are accessible via the internet are regularly monitored and secured against common web application vulnerabilities, including cross-site scripting (XSS), SQL injection, and other emerging cyber threats. Security controls are continuously reviewed and updated to maintain a strong security posture.

External connectivity is protected by enterprise-grade, resilient firewalls, supported by dedicated security monitoring technologies such as Security Information and Event Management (SIEM), Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS). These controls help identify, investigate, and mitigate potential security incidents in a timely manner.

Internet usage is managed through dedicated web filtering solutions that restrict access to inappropriate, malicious, or unauthorised websites and control the types of traffic permitted across the network.

Firewalls and network monitoring tools continuously inspect and manage inbound and outbound traffic to help safeguard organisational systems and data from unauthorised access and cyber threats.

Sensitive and confidential data is processed within secure business systems, including our CRM platform, which are protected by appropriate technical and organisational security measures. In addition, comprehensive security monitoring capabilities, including a dedicated SIEM platform, provide ongoing visibility of the technology environment and support the proactive detection and response to security events.

We are committed to maintaining a secure and trustworthy workforce through robust recruitment, onboarding, and information security practices. Where appropriate, prospective employees undergo screening and verification processes before employment commences, including validation of qualifications, employment history, and other relevant credentials.

All employees receive a comprehensive induction programme that includes training on data protection, confidentiality, information security, and their responsibilities under applicable policies and procedures. This training is reinforced through ongoing awareness initiatives, periodic refresher sessions, and internal communications to ensure staff remain informed of evolving security and compliance requirements.

Each employee is provided with an Employee Handbook outlining organisational policies, standards, and expectations. The handbook is reviewed and updated regularly, with employees notified of any significant changes or additions.

Confidentiality and data protection obligations form a key part of our employment arrangements. Employees are required to comply with confidentiality requirements and, where appropriate, restrictive covenant provisions designed to protect company and client information.

Access to systems and data is controlled through strong authentication measures, including password complexity requirements and regular password updates. When an employee leaves the organisation, their access to all systems, applications, and facilities is revoked promptly to prevent unauthorised access.

We maintain a clear desk and clear screen policy to reduce the risk of unauthorised disclosure of information. Employees are expected to secure their workstations whenever they are away from their desks and to handle company information responsibly at all times.

Specific data security procedures are in place for remote and mobile working arrangements to ensure that personal and confidential information remains protected regardless of where work is undertaken.

To minimise the risk of data loss or unauthorised disclosure, employees are prohibited from storing company or client data on removable media, such as USB devices, or on unauthorised local device storage. All information must be stored and managed through approved and secure business systems and platforms.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and to meet applicable statutory, contractual, and operational requirements. Once the applicable retention period has expired, information is securely deleted, destroyed, or anonymised in accordance with our established procedures.

As a general principle, client records are retained for a period of seven years following the termination or completion of the contractual relationship, unless a longer retention period is required by law, regulation, or specific contractual obligations.

Where confidential paper records are generated or retained, secure disposal arrangements are in place. Confidential waste is collected and destroyed by an approved and vetted third-party provider, who issues a Certificate of Destruction to verify that all materials have been securely and permanently disposed of.

We also maintain a formal hardware disposal process to ensure that all end-of-life IT equipment is managed securely. Prior to disposal, storage media is securely wiped using recognised industry-standard methods to prevent data recovery. Hardware is then destroyed or recycled through an accredited disposal provider, with a Certificate of Destruction obtained as evidence of secure disposal.

These measures help ensure that both physical and electronic information assets are disposed of securely and in accordance with our data protection, information security, and regulatory obligations.