Security & Confidentiality
Intelligence without compromising confidentiality.
What's actually implemented today — not a list of certifications we don't hold.
Website-level technical measures
- Encrypted transport (HTTPS/TLS) for all traffic to this website.
- Standard security headers (Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, HSTS) on every response.
- Server-side rate limiting on all form submissions to reduce automated abuse.
- Server-side input validation and sanitisation on every form field before it is processed or forwarded.
- No third-party advertising trackers.
Credential and data handling
- All API keys and provider credentials (CRM, market-data) are held server-side only and are never exposed in client-side code, page source, or browser network requests visible to a visitor.
- Form submissions are forwarded directly from our server to our internal CRM over an authenticated connection — not stored in client-side storage.
- A confidential engagement (once contracted) uses a controlled information-request process, scoped document-by-document rather than shared as one undifferentiated request.
Access & accountability within engagements
- Role-based access to client documents and data rooms, limited to the team members assigned to that mandate.
- Activity logging on document access within the engagement workspace.
- Data-minimisation: we request only the information a given workstream actually requires, not a blanket copy of everything.
What we do not currently claim
We do not hold ISO 27001 or SOC 2 certification at this time, and we do not claim end-to-end encryption of client data unless and until that is technically confirmed and verifiable. If either becomes accurate, this page will be updated — not before.