Security, Trust and Compliance

ISO 27001 Aligned

Our Information Security Management System (ISMS) is aligned with ISO 27001:2022 standards. We implement the full set of Annex A controls appropriate to our risk profile, including asset management, access control, cryptography, operations security, communications security, and supplier relationships. We conduct regular internal reviews and are working towards formal certification.

Cyber Essentials

We are working towards Cyber Essentials certification and already implement the five key technical controls:

• Firewalls — boundary firewalls and internet gateways configured to protect our network perimeter
• Secure configuration — all devices and software configured securely, with default credentials changed and unnecessary services disabled
• User access control — least-privilege access with multi-factor authentication enforced on all accounts
• Malware protection — anti-malware software deployed on all endpoints with automatic updates enabled
• Patch management — software and operating systems kept up to date with security patches applied within 14 days of release

Data Protection and Privacy

We are registered with the Information Commissioner’s Office (ICO Registration: ZC106950) and fully comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our data protection commitments include:

• Lawful, fair, and transparent processing of personal data
• Data minimisation — we only collect what is necessary for the stated purpose
• EU-hosted database (Supabase, Ireland) for customer data residency
• Encryption at rest and in transit for all personal data
• Data processing agreements in place with all third-party processors
• Documented data retention and deletion procedures

Full details are available in our Privacy Policy.

Business Continuity

Secure Development Practices

• Security by design — security requirements defined at the start of every project and reviewed at each stage
• Code review — all code changes reviewed before merge, with automated security scanning in CI/CD pipelines
• Dependency management — automated dependency scanning with alerts for known vulnerabilities (Dependabot, npm audit)
• Secret management — secrets stored in dedicated vaults (1Password), never in code repositories. Environment variables injected at runtime.
• OWASP compliance — development practices aligned with the OWASP Top 10 and OWASP Application Security Verification Standard (ASVS)
• Penetration testing — regular security assessments and penetration testing of client deliverables

People, Access and Vetting

• Baseline Personnel Security Standard (BPSS) — BPSS clearance processes can be facilitated for staff working on public sector engagements where required
• Least-privilege access — role-based access controls with regular access reviews
• Multi-factor authentication — enforced on all systems, including code repositories, cloud platforms, and administrative tools
• Device security — full-disk encryption, automatic screen lock, and remote wipe capability on all company devices
• Security awareness training — all staff complete security training on joining and annual refresher training thereafter
• Leavers process — access revoked immediately upon departure, with full audit trail

Insurance and Financial Standing

Governance and Published Policies

Social Value

We are committed to delivering measurable social value through every public sector engagement, aligned with PPN 06/20:

• Creating high-quality technology employment and investing in skills development
• Championing fair procurement and supporting SMEs in our supply chain
• Minimising environmental impact through remote-first operations and efficient technology
• Building diverse teams and delivering accessible digital services
• Promoting healthy, flexible working and supporting digital inclusion initiatives

Full details in our Social Value Statement.

Accessibility

We design and build digital products to meet WCAG 2.1 Level AA standards. Our own website uses semantic HTML, keyboard navigation, WAI-ARIA attributes, and respects user motion preferences. We conduct regular accessibility testing using automated tools (axe-core) and manual review. Full details in our Accessibility Statement.

Frameworks and Accreditations