How we earn and keep your trust.
Enterprise and public-sector engagements involve access to sensitive environments. This page sets out how we handle that responsibility — in security, privacy, governance and the people we put on your engagement.
Security in delivery
- Least-privilege access to client environments, granted per engagement and revoked on completion.
- Multi-factor authentication enforced for all consultants and administrative access.
- Secure development practices, code review and secrets management on every build.
- Security architecture reviewed against recognised frameworks including NIST CSF and ISO 27001 control sets.
Data handling & POPIA
- Personal information is processed only where an engagement requires it, under a written mandate.
- Data classification agreed with the client before any environment access is granted.
- Preference for processing within client-controlled environments and South African data residency where required.
- Retention and secure disposal terms defined in every statement of work.
Delivery governance
- Defined scope, deliverables and acceptance criteria before work begins.
- Named engagement lead accountable for quality and communication.
- Fortnightly reporting on progress, risk and dependencies as standard.
- Formal change control for scope, cost or timeline adjustments.
People & vetting
- Background and reference checks appropriate to the sensitivity of the engagement.
- Confidentiality undertakings from all consultants and associates.
- Ongoing certification and skills development across cloud, security and data disciplines.
- Client-specific onboarding and induction where required.
Standards we work to
We are a new firm and we do not hold organisational security certifications yet. We are transparent about that, and about what we do instead.
Our delivery methods are built against published frameworks: ISO 9001 for quality management, ISO/IEC 27001 control sets for information security, the NIST Cybersecurity Framework for security architecture, and POPIA and the Cybercrimes Act for South African regulatory obligations.
Our founder holds Lead Auditor credentials through CMI South Africa, so audit-grade documentation is how we work rather than something we add at the end.
Certification roadmap
ISO 9001 certification of our own management system is targeted before we take on managed service commitments. Cloud partner programme enrolments and SOC 2 Type I will follow as the practice grows. We will publish certificate numbers and partner IDs here when they exist, and not before.
Need our security documentation?
We provide security questionnaires, insurance details, vetting confirmations and references as part of procurement and vendor onboarding. Contact us and we will return the pack within two business days.
Request documentationLet's discuss your next initiative.
Speak to our team about your digital infrastructure, cybersecurity, data or analytics requirements. We respond to every enquiry within one business day.