Information Security

A public overview of our approach to information security, suitable for procurement evaluation. Detailed documentation is provided privately on request.

Principles

We apply least privilege, defense in depth, and data minimization. Security is treated as a design constraint, not an afterthought.

Architecture and data handling

Access is controlled and logged. Data is segregated and handled according to its sensitivity, with encryption in transit and at rest where appropriate.

Vendor posture

We evaluate vendors against jurisdiction, ownership, and security criteria, and we do not engage vendors whose posture would create unacceptable risk for the missions our clients support.

Personnel

Personnel are subject to appropriate screening for their role, bound by confidentiality obligations, and granted access on a need-to-know basis.

Incident response

We maintain incident-response procedures and notify affected clients of material incidents in accordance with applicable agreements and law.

Compliance and threat awareness

We align our controls with recognized standards and maintain awareness of the threat environment relevant to the ecosystems we cover.