Security Statement

What is in place today, what is being built, and what is on the roadmap. We are a young operation and we would rather give you a short list you can verify on a call than a long one you cannot. This page is dated and is updated as controls go in.

1. Our posture, stated plainly

2. In place today

Each item below can be shown to you on a call: the signed document, the setting, the log.

• Confidentiality agreement signed by every agent before they touch a client programme, surviving after they leave. Every agent also signs the employee handbook, which carries the data handling rules, and re-signs when it changes.
• Recorded lines with disclosure, paused for sensitive details. Every call opens with a recording disclosure. Agents pause the recording while a customer gives identity or payment details and resume it afterwards, so those details are not captured. Recordings are retained for quality review and dispute resolution.
• No sensitive customer data in our systems. Agents record name, service address, phone and email only. Identity numbers, dates of birth and payment details go directly into the client's or provider's own portal and are never repeated aloud, written down, messaged or kept. This rule is in the call script, the handbook and the agent's signed agreement.
• Role-based access on our operations platform. Each person has an individual login and sees only what their role needs; agents see their own leads, sales and pay, not each other's. Idle sessions are signed out. Login attempts are throttled.
• Two-step verification on the accounts that hold the platform, its data and this website.
• Nightly backups of operational data to a separate, owner-only location, kept for 30 days, with an alert if a backup is missed.
• Floor rules: clean desk, no removable media on company devices, personal phone use restricted at the desk.
• Same-day removal of access when someone leaves.

3. In progress

• Written data handling statement: what we hold, why, for how long and who can see it. Available to any client on request once published.
• Change audit trail on the operations platform: who changed what, and when, for every record.
• Separate credential store for platform logins, apart from operational data.

4. Roadmap

• SOC 2 Type II. Controls first, audit when a client engagement requires it.
• ISO/IEC 27001, on the same basis.
• Independent penetration test of the operations platform, arranged for a specific engagement where a client requires it.
• Background verification on every hire as a documented standard, in addition to reference and identity checks at onboarding.
• HIPAA and GDPR paperwork (Business Associate Agreement, Data Processing Agreement) put in place with the first engagement that needs them.
• Dedicated, access-controlled floor space for regulated programmes.
• Documented business continuity plan with tested recovery, beyond the backups already in place.

5. Certification status

6. How client and customer data is handled

• Data minimisation: we ask for, and record, the narrowest data set that lets us deliver the service.
• Agents work inside the client's own systems under the client's licences and access controls wherever the client prefers, so the client's data stays in the client's environment.
• Data held in our own platform is encrypted in transit and at rest by the platform provider.
• Retention: where an engagement does not specify a period, client data is kept for the duration of the engagement and returned or deleted within 30 days of termination. Call recordings follow the client's requirement, or 12 months by default.
• Client programmes are kept separate in our platform; an agent on one programme cannot see another.

7. AI systems

• Client data is not used to train third-party foundation models.
• AI-generated output in regulated or high-impact contexts is subject to human review or escalation.
• Every AI-supported workflow, and every AI-delivered language, is documented in the SOW.

8. Incident response

If we confirm a security incident or personal data breach affecting a client, we notify that client without undue delay and within any period specified in the applicable agreement, tell them what we know and what we are doing about it, and support them in meeting their own regulatory notification obligations. A written incident procedure is part of the in-progress work in section 3.

9. What we ask of clients

Security is shared. We ask clients to provision access on a least-privilege basis, to notify us promptly of leavers on their side, to keep any DPAs and BAAs current, and to tell us in advance when a programme's data classification changes.

10. Reporting a vulnerability