SECURITY
How we protect your business systems and data.
Plain-language answers for business owners and the security questions your team or insurer will ask.
Our controls
Our commitments
| Commitment | Detail |
|---|---|
| Incident notice | We tell you within 24 hours of any suspected incident |
| Clean exit | Access removed the same day; documentation returned within 5 business days |
| Data protection | Agreement, signed before work starts, covering US privacy laws, UK GDPR, EU GDPR and the Australian Privacy Act |
| Certification | ISO 27001 readiness under way (see the certification roadmap) |
Questions
Do you store our data?
No. We work inside your systems through logged access and keep no copies.
Can we see who accessed what?
Yes. Sessions are logged, and only your named team has access.
Will you complete our security questionnaire?
Yes, in full within 3 business days.
Report a security issue
Found a vulnerability in our website or services? Email [email protected] with the subject "Security report", what you found and how to reproduce it. We reply within 2 business days and keep you updated until it's fixed.
Please test only against your own accounts, don't access or change other people's data, and give us reasonable time to fix the issue before you share it. We won't take legal action against good-faith research that follows these rules. Our contact file is at /.well-known/security.txt.
Security questions? Ask an expert.
We answer them on a 20-minute call, or in writing within 3 business days.