Loading...
Loading...
Trust Centre
We protect our clients' most sensitive information and systems. Here is how we earn and maintain that trust through rigorous security practices, compliance, and transparency.
Security Practices
We apply the same security rigor to our own infrastructure that we recommend to our clients. Here are the key practices that underpin our operations.
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. We enforce encryption across all client communications, storage systems, and internal tools.
Our internal systems follow zero-trust principles. Every access request is verified, authenticated with MFA, and logged. No implicit trust is granted to any user or device.
Our own SOC monitors our infrastructure 24/7 with the same rigor we apply to client environments. Anomalies are investigated within minutes, not hours.
Production systems run on hardened, regularly patched infrastructure with network segmentation, intrusion detection, and automated vulnerability scanning.
All team members undergo background checks, sign NDAs, and complete security awareness training quarterly. Access follows least-privilege principles.
Comprehensive disaster recovery and business continuity plans tested annually. Redundant systems and backups ensure service availability.
Compliance Certifications
Our compliance posture is validated through independent audits and certifications.
Our security controls are independently audited against AICPA Trust Service Criteria. SOC 2 Type II reports are available to clients under NDA.
Our information security management system is aligned with ISO 27001 standards, covering risk management, access control, and incident response.
We process personal data in accordance with GDPR requirements, including data minimization, purpose limitation, and data subject rights.
Our infrastructure and processes are designed to support HIPAA compliance for healthcare clients, with BAAs available upon request.
Data Handling
We take data stewardship seriously. Here is how we handle client data.
Incident Response
In the event of a security incident affecting our systems or client data, we follow a rigorous response process.
Automated monitoring and analyst investigation identify potential security incidents within our environment or affecting client data.
Incidents are classified by severity and impact. Affected clients are notified within 24 hours of confirmed incidents per contractual obligations.
Immediate containment actions are taken to prevent further damage, followed by root cause analysis and full remediation.
A thorough post-incident review is conducted, lessons learned are documented, and preventive measures are implemented to avoid recurrence.
Our security team is available to discuss our practices, provide compliance documentation, or address any security concerns you may have.