Security & data protection

We work with EU institutions, defence organisations and large enterprises. Protecting their data — and yours — is part of how we work every day.

Confidentiality

All team members are bound by confidentiality obligations. We respect the security rules and classification requirements of each client environment.

Client data stays in client-controlled environments whenever possible; we only process what is needed for the assignment.

Secure by design

Security is part of architecture and delivery from the start: threat modelling, least-privilege access, secure coding practices, code review and dependency management.

Encryption in transit (TLS/HTTPS) everywhere, and encryption at rest where the client environment allows.

GDPR & data protection

We apply data protection by design and by default, data minimisation and defined retention periods, and sign data processing agreements where we act as processor.

Our website uses no third-party trackers and serves all resources from our own EU-hosted server.

Security audits & reviews

We regularly review the security of our own systems and practices, and we support our clients’ security audits, assessments and compliance reviews of the systems we build.

We can also carry out architecture and security reviews of existing platforms as part of our cybersecurity services.

Incident response

Security incidents are handled through a defined response process. Where personal data is affected, we notify the controller without undue delay so that GDPR obligations — including the 72-hour notification to authorities — can be met.

Responsible disclosure

If you believe you have found a vulnerability in our website or services, please email [email protected] with the subject "Security". Do not publicly disclose it before we have had a reasonable time to fix it. We will respond promptly.