How we handle your credentials, data and environments
Most identity and data projects put us inside sensitive systems. This page lists what our engineers do on every engagement. These are working practices. We don't present them as certifications.
At a glance
Least-privilege access
Our access requests are narrow on purpose. One role, enough for the task, scoped to the environments in the statement of work, and removed as soon as the task is done.
No credentials in email or chat
Passwords, API keys and tokens never travel by email, chat or tickets. You share them through your own vault or a one-time secret link your security team approves.
Your vault, your logs
Where possible we check out credentials from your PAM tool or secrets manager, so every session is recorded in your system and you can revoke it without asking us.
Data minimisation
If masked or synthetic data will do the job, we use it. Production data doesn't get copied onto our own machines or storage if we can avoid it.
Before the engagement starts
A mutual NDA comes first, before any discovery that touches your architecture, data or configuration. Then the statement of work names the systems and environments in scope. If it isn’t on that list, we don’t touch it until you add it in writing.
We will fill in your vendor security questionnaire.
Access
Our engineers ask for named accounts, never shared ones. Each account gets the least privilege that covers the task in front of it: read-only for a health check, a scoped admin role in a non-production tenant for an upgrade rehearsal, and production rights only for the cutover window you agree to.
Every account we use has MFA. If your platform supports phishing-resistant methods such as FIDO2 keys or platform passkeys, we will use them.
When a piece of work finishes, we send you a list of the accounts and roles we held so your team can remove or disable them. We would rather you revoke too early than too late.
Credentials and secrets
We don’t take credentials by email, chat, text message or ticket comments. If a secret arrives that way by accident, we tell you and ask you to rotate it.
Our preference is that we never hold your secrets at all. Where you run CyberArk, BeyondTrust, Delinea, HashiCorp Vault or a cloud secrets manager, we check credentials out through it, so sessions are brokered and recorded on your side. Service-account passwords and API keys we create during a build are stored in your vault and rotated at hand-over.
Data
Most identity and platform work doesn’t need real personal data. In lower environments we ask for masked or synthetic data, and production data stays in production. Sometimes a task needs a sample, say to validate an HR feed mapping. Then we agree the fields and the smallest record count first, work on it inside your environment and delete any working copies when the task closes.
We do not put client data, configuration exports or source code into public AI tools.
Environments and changes
Changes go to non-production first. We rehearse upgrades and migrations against a copy of your configuration, write down the rollback steps, and run production changes inside a window your change board has approved. Your team keeps ownership of the change record.
If something goes wrong
If we suspect a credential or data exposure on our side, we tell your named security contact as soon as we know, share what we know, and help with rotation and review.
01Will you sign our NDA and security addendum?
Yes, and we'd expect to sign the NDA before discovery. Your security addendum or vendor questionnaire gets reviewed as part of contracting. Where a clause needs changing, we'll say which one and why.
02Can your engineers work only inside our environment?
Yes. We are comfortable working entirely through your VDI, jump hosts or managed laptops, using your accounts and your MFA. That is often the simplest way to meet your access policy.
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it