How We Protect Your Business, in Plain Words

• Your email, files and user accounts live in your own Microsoft 365 or Google Workspace account, registered to your company. We manage it for you. We don't keep copies of your files on our systems.
• Licences are bought in your company's name, so they belong to you, not to us.
• Your domain name goes in your own Cloudflare account, set up in your company's name. We're added as a manager, so you always hold the keys and we can still do the work.

• Multi-factor sign-in on every account we use to manage yours. No exceptions for convenience.
• Separate admin credentials for every client, kept in our Keeper password vault. Never shared between clients, never sent by email or text.
• Remote support runs through our monitoring platform, and every remote session is logged.
• Nobody keeps standing admin rights on your computers, including your own staff. Admin access is approved one task at a time and recorded.

• Monitoring and automatic security updates for Windows and your everyday software.
• Email security that screens for phishing and malicious links before they reach the inbox.
• A business password manager for your team, so passwords stop living in spreadsheets and sticky notes.
• Email domain protection (SPF, DKIM and DMARC), so it's much harder for someone to send mail pretending to be you.
• Antivirus with endpoint detection and response, watched for signs of an attacker, not just known viruses.
• Backup of your Microsoft 365 or Google data, sized to what you actually need.

• Any request to change bank details, payment information or wire instructions is confirmed by phone, at a number we already have on file. Never the number in the email.
• We will never ask for your password by email, text or phone.
• New accounts, password resets and access for new staff go through a written request, so there's a record of who asked.

• We follow written response steps for a compromised account: lock it, reset it, check for hidden forwarding rules, review the sign-in history and confirm nothing else was touched.
• We tell you what happened, what we did and what it means, in plain words, the same day.
• If your insurer or a regulator needs a report, we write up the timeline for you.

• You get a clean handoff: admin credentials, documentation and licence details, handed to you or your next provider.
• Our access is removed and our monitoring tools are uninstalled, and we confirm it in writing.
• Nothing of yours is held back to keep you as a client.

We use AI in our own work and build it for clients. The same rules apply.

• AI only sees the systems you approve, and each connection gets the least access it needs.
• Anything that sends a message, moves money or changes a system waits for a person to approve it.
• We use business accounts with AI providers, which don't train their models on your data by default.