01Where your data lives
IN SHORTIn your accounts where possible; when we host, you get a written list.
We build in your cloud accounts and repositories whenever we can, so you hold the keys. When we host something for you, we agree the region with you and you get a written list of what is stored and where.
02Who can access it
IN SHORTNamed people only, logged, removed at handover.
Only the named people on your project, as introduced to you before they start. Each has their own account; we never share logins.
- Production access is requested in writing and limited to what the work needs.
- Access is logged, and the log is yours.
- All our access is removed at handover, and we confirm it in writing.
03How we protect it
IN SHORTEncrypted devices, two-factor sign-in, secrets kept out of code, reviewed changes.
| AREA | WHAT WE DO |
|---|---|
| Devices | Full-disk encryption, screen lock, automatic updates |
| Accounts | Two-factor sign-in on every account that offers it |
| Secrets | Kept in the host's secret store, never in code or chat |
| Code | Reviewed before it ships, with automated checks on every change |
04This website
IN SHORTBriefs and signups sit in a database only our server can reach.
Briefs and signups are saved to a database that only the site's server can read; the public key can read nothing. Every page is served over HTTPS with strict security headers, form sends are rate-limited, and every change runs automated checks before it ships.
05AI tools on client work
AI & DATA HANDLINGIN SHORTOnly with your written OK, with no training on your data, and reviewed by a person.
We use AI coding and analysis tools on your code or data only if you agree in writing. Approved tools are set up so your data isn't used for training. A person reviews agent work before it is merged.
06Incidents
IN SHORTWe tell you as soon as we know, in time for your own duties.
If something goes wrong that affects your data, we tell you as soon as we know (what happened, what we know, and what we are doing) and help you meet your own notification duties, such as the 72 hours GDPR gives a controller.
07Reporting a vulnerability
IN SHORTEmail us. We reply within 1 business day and never sue good-faith research.
Email security@sjkconsult.com with what you found and how to reproduce it. Please give us reasonable time to fix it before you disclose it. We will not take legal action against good-faith research, and we credit reporters who want it.