Code of Conduct

Access

• We take the narrowest access that lets us do the agreed work, and ask before taking more.
• Your domains, hosting and servers stay registered in your name. We are a guest in your accounts, never the owner of them.
• At the end of an engagement we hand over what we hold and remove our own access.
• Credentials are held in a password manager, never in a document, a chat thread or an email.

Scope

The written inventory defines what is covered. If work falls outside it, we say so and quote before starting, rather than doing it and invoicing for it. System limits are indicative ceilings, not a measure of good faith; the inventory is what matters.

Communication

• Enquiries are answered within one business day.
• On Operations, a production outage is triaged within four business hours.
• You are told what we found and what we could not do, in writing, rather than left to infer it.
• We do not promise a resolution time or an uptime figure, because we could not keep either promise.

Confidentiality

An NDA is signed before onboarding if you want one. We do not name clients or describe their systems publicly, and we do not publish anything about a client that they have not agreed to in writing.

What we will not do

We will not run intrusive testing you have not specifically authorised. We will not claim a certification, an audit or a compliance standard we have not been assessed against. We will not present an estimate as a measurement or a sample as a real result.

Raising a concern

If something here has not been met, say so. Email [email protected] and it will be looked at directly. We would rather be told than find out later.

Company details

Company registration details will be published here once the UK entity is incorporated.