How we protect what you trust us with
Every engagement puts us close to sensitive information — investor relationships, board papers, financial detail, internal strategy. Here's exactly how that's protected.
Mutual NDA, before anything else
Before any account access is set up, we sign a mutual non-disclosure agreement covering the engagement. Nothing is shared, opened or connected before that's in place.
Access on a need-to-know basis
Only the people actually working on your account get access to your tools, inboxes and documents — never the wider team. Access is granted per-engagement, not shared across clients.
- Logins and credentials are shared through a password manager, never by email or chat.
- Where your tools support it, we work through role-based or delegated access rather than your own personal login.
- Two-factor authentication is required on every account we touch that supports it.
Data handling
Documents and data stay within the tools you already use (your drive, your CRM, your inbox) wherever possible, rather than being copied out to ours. Where something does need to be stored on our side to do the work, it's kept in access-controlled, encrypted storage for the duration of the engagement only.
Offboarding
When an engagement ends, access is revoked the same day, and any of your data held on our side is returned or deleted within 14 days, confirmed in writing.
Questions before you start
If your business has its own data-processing or security questionnaire, we're happy to complete it as part of onboarding — just raise it on your strategy call.