How we look after your systems and your data.
More UK businesses now check the suppliers they let near their systems: 15 per cent review the cyber risks posed by their suppliers, rising to 48 per cent of large firms (Cyber Security Breaches Survey, April 2026). These are the practices we follow on every project, published so you can see them before you ask.
- Free 30-minute call
- Fixed quote in writing
- Code you own
Six areas, written down.
A security question about your project? Ask an engineer.
Thirty minutes with a senior engineer, free and with no obligation. Bring the problem, not a brief.
Sending us a security questionnaire?
Good. We complete supplier security questionnaires honestly and in writing, and we can provide our Data Processing Addendum, a list of the sub-processors your project would use, showing where each one processes data, and a description of the practices on this page.
If your own customers send you questionnaires, or you are working towards Cyber Essentials, ISO 27001 or the NHS Data Security and Protection Toolkit, we build and document your systems to support that work. The certification itself is yours to obtain through the relevant scheme.
Frequently asked questions.
Will you complete our supplier security questionnaire?
Yes. Send it through the contact form or ask on a call, and we will complete it honestly and in writing. Where a question does not apply, or a control is handled by a hosting provider rather than by us, we say so and explain who is responsible.
Where is our data hosted?
Where you need it to be. We can host on AWS, Google Cloud or Azure in their UK regions, or in the EU. Any provider that processes data outside the UK is listed in your sub-processor list with the transfer safeguard used, so nothing is hidden.
Do you sign a Data Processing Addendum and an NDA?
Yes. Our Data Processing Addendum meets the requirements of Article 28 of the UK GDPR and comes with every statement of work that involves personal data. We sign a mutual NDA before any detailed discussion where you need one. Both are ready before work starts.
Do you use AI tools on our code or data?
We use AI tools for parts of our engineering work, under the same confidentiality rules as everything else, and our engineers review what they produce. If you would prefer some code or data never to be processed by AI tools, tell us and we will agree that in writing.
What happens to our data when the project ends?
We return or delete it, as you choose, unless the law requires us to keep it, and we confirm deletion in writing if you ask. Access to your systems is removed at the same time, and your accounts and credentials stay with you.
Can you help us meet our own security obligations?
Yes. We build systems with access control, logging, backups and documentation that support Cyber Essentials, ISO 27001, the NHS Data Security and Protection Toolkit and your customers' requirements. Certification itself comes through the relevant scheme, so we never claim to make you certified.
Still have a question? Ring 07723 431000 and speak to an engineer.