How we protect your data.
We help organizations govern their data, so we hold ourselves to the same standard. These are the commitments we make on every engagement.
Secure sharing, never attachments
Client data is exchanged through restricted, access-controlled shared folders, not email attachments or web forms.
Least-privilege access
Only the people working on your engagement can see your data, and access is removed as soon as it is no longer needed.
Encryption and strong sign-in
Data is stored on enterprise cloud platforms that encrypt it in transit and at rest, and every account is protected with multi-factor authentication.
Your data never trains AI
We never put client data into public AI tools, and it is never used to train AI models.
Work in your environment
Whenever possible we work inside your systems and accounts, so sensitive data never has to leave your control.
Deleted when the work is done
At the end of an engagement we return or securely delete your data on a schedule we agree with you in writing.
Agreements in place
We sign NDAs and data processing agreements, and business associate agreements when health information is involved.
Prompt incident notice
If a security incident ever affects your data, we will notify you within [X] hours with what happened and what we are doing about it.
Have a security questionnaire?
We are happy to complete your vendor risk assessment and walk your security team through how we handle data before any work begins.