All internal user accounts must present an additional verification factor beyond a password, significantly reducing the risk of compromise from stolen credentials.

Centralized SAML and OIDC authentication streamlines user access while allowing customers to enforce their own identity policies.

Strong password requirements and the required use of hardware or platform security keys minimise the likelihood of brute-force and credential reuse attacks.

Accounts are automatically suspended after multiple failed login attempts, blocking automated guessing and alerting security teams to suspicious activity.

Access rights are revoked immediately when an employee departs, preventing orphaned accounts and reducing insider threat exposure.

A documented RBAC matrix assigns permissions strictly according to job responsibilities, ensuring users can only perform authorised actions.

Default permissions start at the minimum necessary level and are elevated only when justified, limiting potential damage from compromised accounts.

Separate administrative accounts and dedicated controls isolate high-risk privileges from day-to-day user access.

Time-bound, approval-based access to production systems eliminates standing privileges and lowers the attack surface.

Critical functions such as code development and approval are intentionally split among different roles to prevent fraud and error.

All stored data, databases and backups are encrypted using strong industry algorithms to prevent unauthorised disclosure if media is lost or stolen.

TLS protects every network connection so data remains confidential and tamper-proof while moving between users, services and regions.

Information is categorised into critical, confidential and public tiers, allowing tailored controls that match sensitivity and regulatory needs.

Defined schedules and a 30-day right-to-erasure process ensure data is kept only as long as required and is securely removed when no longer needed.

Only the data strictly necessary for stated purposes is collected and processed, reducing privacy risk and compliance scope.

Customer data is hosted exclusively within European jurisdictions and replicated across multiple availability zones for high availability.

Production, staging and development environments are isolated with default-deny rules so lateral movement is heavily restricted.

All inbound traffic passes through filtering and traffic-scrubbing layers that block common exploits and large-scale denial-of-service attacks.

Network and host-based sensors continuously monitor for malicious activity, triggering real-time alerts for rapid response.

Baseline configurations follow recognised security benchmarks and are enforced via infrastructure-as-code for consistent, hardened deployments.

All features undergo structured security reviews, integrating best practices from design through deployment for proactive risk reduction.

SAST, DAST, secret detection and third-party library checks run in CI/CD pipelines to identify issues before they reach production.

Accredited testers perform annual assessments to validate defenses and provide independent assurance of application resilience.

A private vulnerability disclosure initiative rewards researchers for responsibly reporting security issues, enhancing overall coverage.

OAuth-based authentication, scoped API keys, strict input validation and rate limiting protect programmatic interfaces from abuse.

Clearly defined roles and time-bound SLAs guide the team to triage and resolve security incidents within hours, minimising business impact.

Authorities, affected individuals and customers are notified within strict timelines, meeting GDPR and contractual expectations.

Recovery time and point objectives of under 12 and 6 hours respectively set tangible targets for service restoration.

Regular exercises validate that backup and restoration processes meet recovery objectives and uncover areas for improvement.

Tabletop and full simulations test organisational readiness, ensuring critical operations continue during disruptive events.

Centralised log correlation delivers real-time visibility across infrastructure and applications for rapid threat identification.

Security events automatically generate actionable alerts, streamlining response workflows and reducing mean time to detect.

External threat feeds enrich detections, allowing proactive blocking of emerging indicators of compromise.

Behavioural baselining highlights anomalous user actions that could signal compromised accounts or insider threats.

Critical system files are continuously checked for unauthorised changes, adding an extra layer of tamper detection.

Regular automated scans uncover known vulnerabilities, ensuring prompt remediation before exploitation.

Critical security fixes are applied within 24 hours under an established emergency process to mitigate active threats.

All other updates are deployed within 30 days, keeping systems current and resilient against emerging risks.

Servers are rebuilt from hardened images rather than patched in place, eliminating configuration drift and hidden persistence.

All company devices run managed EDR with real-time behavioural analysis to detect and stop malware and ransomware.

Candidates with access to sensitive data undergo screening to validate trustworthiness before hiring.

Mandatory onboarding and annual refresher courses keep staff informed about current threats and safe practices.

Developers receive annual training aligned to OWASP guidance, improving code quality and reducing vulnerabilities.

Regular tests measure employee readiness and reinforce good email hygiene through immediate feedback.

All personnel sign binding policies and NDAs, establishing clear expectations and legal accountability for data handling.

Accredited third parties perform ongoing surveillance audits to verify adherence to the organisation’s AI governance framework.

Automated filtering detects and removes sensitive or harmful content, mitigating prompt injection and data leakage risks.

Customer information is excluded from model training activities, preserving confidentiality and intellectual property.

All model inference is executed on infrastructure located within the European Union, supporting regional compliance obligations.

Detailed evidence of conformity with the EU AI Act is maintained and shared with customers upon request.

Processes, technical measures and DPO oversight ensure continuous alignment with European data protection requirements.

Controls meet the EU Network and Information Security Directive, demonstrating resilience of essential digital services.

All eighteen CIS Critical Security Controls are in place, reflecting a comprehensive, prioritised defence strategy.

Risk management activities map to the five NIST CSF functions, enabling structured governance and continuous improvement.

All critical service providers undergo due-diligence reviews prior to onboarding to validate their security posture.

Periodic reassessments verify ongoing compliance with security requirements and evolving threats.

A maintained inventory records each supplier’s purpose, risk rating and contract status for easy oversight.

Data processing agreements, NDAs and security obligations are embedded in every vendor contract to enforce protections.

Dedicated insurance provides financial resilience against potential third-party or internal security incidents.

All company laptops and mobiles are centrally managed to enforce policies, apply updates and monitor compliance.

Mandatory encryption protects data on endpoints, ensuring confidentiality if a device is lost or stolen.

Security teams can erase data on compromised or missing devices to prevent unauthorised access.

Secure tunnels are required for reaching internal resources, shielding them from exposure to public networks.

Devices lock after periods of inactivity, reducing the risk of unauthorised viewing in shared or remote environments.

Real-time availability metrics are published, offering immediate insight into platform performance.

Round-the-clock checks detect disruptions quickly and trigger internal response to minimise downtime.

Past incidents and resolutions are openly documented, demonstrating accountability and learning culture.

Clear channels, including encrypted email, enable researchers to responsibly disclose vulnerabilities.

Customers can review the current data processors and are informed before any material changes, supporting supply-chain transparency.