This statement sets out how we keep data secure across all our work. It applies to our directors and to every associate who handles data for us.
1. Devices
Every device we use for work:
- runs an up-to-date, supported operating system with automatic security updates turned on
- has full-disk encryption turned on, for example FileVault on a Mac, BitLocker on Windows or LUKS on Linux
- locks its screen after a short time without use
- has malware protection where the device supports it.
Other people do not use our work devices. If a device is lost or stolen, we tell a director straight away so we can shut off its access and, where possible, wipe it.
2. Accounts and passwords
We use a password manager and a unique, strong password for every account. We turn on two-factor login for email, file storage and any system that holds client or participant data. We never share login details by email or chat.
3. Sending data
We use encrypted connections for everything we send online. We never send personal or sensitive data as an ordinary email attachment. We share it through encrypted storage or encrypted email instead.
4. Where we store data
| Service | What we use it for | Where the provider is based |
|---|---|---|
| Proton Drive | Storing project files and records | Switzerland, with data held in Europe |
| Tuta Mail | Germany | |
| Etherpad and Kan, run for us on PikaPods | Shared notes and task boards | EU |
| listmonk, which we run ourselves on OVHcloud | Sending Signals, our newsletter | United Kingdom data centre |
| Framagit Pages, run by Framasoft | Hosting our websites | France |
| Google Drive | Working on documents with clients or partners who use it. We never store personal or sensitive data there | United States, covered by the UK–US data bridge |
| A client's own systems | Only when a client asks, for the data and time it agrees | As agreed with the client |
We chose these services for their approach to privacy and, where it matters, for keeping data in Europe. Our AI use policy covers AI tools.
5. Who can see data
Only directors and the associates working on a project can see that project's data. When an associate's work with us ends, we remove their access within one week and check that they have returned or deleted our data.
6. Backups
We back up project files and company records using the backup features built into our storage services. That way, we can recover data if someone deletes it by mistake or a device fails. Backups follow the same access rules as live data.
7. Deleting data
We delete or anonymise data at the end of the period set out in our data protection policy, or sooner if a client asks. We keep a simple log of what we deleted, when and who deleted it.
8. If something goes wrong
We tell a director straight away about any lost device, suspected break-in, phishing attempt or access by someone who should not have it. We then follow the breach steps in our data protection policy. These include deciding whether to tell the Information Commissioner's Office, a client or the people affected.
9. Reviewing this statement
We review this statement every year, and whenever we start or stop using a major service.