Confidentiality Policy

1. Definition of confidential information

Confidential information includes business plans, financial information, customer and employee data, source code, technical documentation, commercial terms, and any information marked confidential or that a reasonable person would understand to be confidential.

2. Obligations

• Confidential information is used solely for the purpose of delivering the engagement
• Access is granted on a least-privilege basis to personnel who require it
• Information is not disclosed to third parties without written consent, except where legally compelled
• Where legally compelled to disclose, we notify you in advance unless prohibited from doing so
• Obligations survive termination of the engagement indefinitely for trade secrets and for five years for other confidential information

3. Personnel

All Company personnel and contractors are bound by written confidentiality obligations as a condition of engagement. Access to client environments is provisioned individually, logged and revoked on role change or departure.

4. Technical safeguards

• Encryption in transit and at rest for client data
• Access control with individual accounts and multi-factor authentication
• Audit logging of access to client systems and data
• Segregated environments between clients
• Secure credential management with no shared accounts

5. Client materials and data

Client data provided for development or testing is used only for the stated purpose. Where production data is required for testing, it is anonymised or pseudonymised wherever technically practical, and its use is agreed in writing beforehand.

6. Return and destruction

On engagement completion, or at your request at any time, client materials are returned or securely destroyed, except where retention is required by law or professional obligation. Written confirmation of destruction is provided on request.

7. Portfolio and references

We do not disclose client identity, project detail or commercial terms in marketing material without written consent. Where consent is given, the specific content is agreed with you before publication. Case studies published without named attribution are generalised so that the client is not identifiable.

8. Mutual agreements

We execute a mutual non-disclosure agreement before discovery on request, and as standard for engagements involving regulated data or material commercial sensitivity.