We are a target too, and we manage ourselves accordingly.
An IT provider holds privileged access to every client environment it supports, which makes providers an attractive target in their own right. We take that responsibility seriously and we are willing to show our work.
Your provider's security is part of your security.
Attacks that compromise a managed service provider in order to reach its clients are a well-documented pattern, not a hypothetical. A provider breach can put every connected client environment at risk at once, which is exactly why the provider's own controls matter.
That means the security questions you ask us are entirely reasonable, and we would rather you asked them.
How we secure our own operations
SOC 2 Type II independently audited
Our security controls have been independently examined over a period of time rather than at a single point. That is the meaningful version of the claim.
Controlled privileged access
Access to client environments is granted deliberately, scoped to what a role requires, and reviewed — not shared broadly by default.
Multifactor authentication
Enforced on our own systems and on the tooling used to reach client environments.
Logging and monitoring
Our own environment and the tooling we use to reach client systems are monitored to the same standard as the environments we manage.
Documented incident response
A defined process for identifying, containing and communicating about incidents, including how and when clients are notified.
Ongoing team training
Security awareness and role-specific training for our own staff, held to the same standard we ask of clients.
Answering your security questionnaire
If your organization needs to assess us as a vendor, ask. We are used to security questionnaires, vendor risk reviews and the documentation that supports them.
We would rather answer specific questions with evidence than ask you to rely on assurances. It is also the same work we help clients do when their own customers and insurers come asking.
What we will not claim
We will not tell you that any environment is unbreachable, that a product eliminates risk, or that a certification guarantees an outcome. None of those things would be accurate.
What we will do is be specific about which controls are in place, which are planned, and where residual risk remains.
Our Trust Center
Our Trust Center publishes our current security posture, attestations and supporting documentation, so you can review the detail directly rather than relying on our summary of it.
Common questions
Can we see your SOC 2 report?
Contact us and we will discuss what can be shared and under what terms. Reports of this kind are typically shared with prospective and current clients under an appropriate agreement.
How do you control access to our systems?
Access is scoped to what a role requires, protected by multifactor authentication, logged, and reviewed. We can walk through the specifics for your environment.
What happens if you have a security incident?
We have a documented response process covering identification, containment, remediation and client communication. Notification expectations are part of the conversation before you become a client, not after.
Have security questions about working with us?
Ask them. We would rather answer specifics than offer reassurance.