Security and assurance, answered in full.

The main security surface of a consultancy is its people. The screening, substitution and confidentiality commitments below are written into the engagement agreement. Delivery teams are two or three senior people, with James Rooney accountable on every engagement; every associate is someone he has already delivered alongside, and nobody is recruited after a client commits. The people on your engagement are not substituted without your written agreement. BS7858-standard screening (identity, right to work, employment history and criminal record checks) completed before any client access, for employees and associates alike. Associates are contracted under the same confidentiality, screening and data-handling obligations as employees, with no onward sub-contracting without your consent. Confidentiality obligations survive the end of the engagement indefinitely.

Our default is to work on your infrastructure under your controls, rather than pulling your data out to ours. We use your identity provider, your access controls and your devices where you provide them. Working software is built and deployed on your infrastructure and designed around your organisation's policies, so there is nothing to migrate off our estate when the engagement ends. Access is requested against the principle of least privilege and time-boxed to the engagement, with a documented offboarding step on exit. Where we use our own devices, they are full-disk encrypted, MDM-managed, screen-locked and remotely wipeable. Client data is not copied to Tenhaw-controlled storage unless the engagement agreement expressly permits it. We do not retain client production data after an engagement ends; retention and deletion terms are set in the Data Processing Agreement.

Where engagement data is processed, and under what terms. Engagement data is processed in the United Kingdom by default, with EU residency available where your policy requires it. Our default is to work inside your estate under your controls, so in most engagements your data never leaves your own infrastructure. Where data does reach our systems, it is processed in the UK on encrypted, MDM-managed devices and deleted at engagement end under the terms of the Data Processing Agreement. Every engagement sub-processor is published on this page with entity, location, purpose and transfer mechanism, and annexed to the Data Processing Agreement.

The full sub-processor list for consulting engagements, as annexed to the Data Processing Agreement. It is short, because delivery happens inside your estate. Google Workspace (Google Ireland Limited): business email, calendar and documents carrying engagement correspondence and client contact details, processed in the UK and EU, with any US support access governed by the UK Addendum to the EU Standard Contractual Clauses. Close (Elastic Inc., United States): customer relationship management holding client contact records, under the UK International Data Transfer Addendum and Standard Contractual Clauses. Cal.com Inc. (United States): scheduling, processing the name, email address and meeting details provided when booking a call, under Standard Contractual Clauses. Model providers (Anthropic, OpenAI and Google): only content named and approved by you in writing for your engagement, under zero-retention or enterprise agreements. The processors behind this website are listed separately in the Privacy Policy and do not touch engagement data.

What happens if something goes wrong, and how quickly you hear about it. A personal data breach affecting your data is notified to you without undue delay, and in any event within 24 hours of us becoming aware of it, as a term of the Data Processing Agreement, so your own 72-hour regulatory clock starts with time to spare. A security incident touching your engagement is raised with your named contact by the route agreed at kickoff, with an initial notification first and updates as the investigation progresses. A written incident report follows, covering root cause, impact and remediation, and we stay engaged until your own team closes the incident. Vulnerability reports to security@tenhaw.com are acknowledged within two working days, and we do not take legal action against good-faith research.

AI-accelerated delivery runs under the same engineering controls as any other build. They run in the pipeline from the first commit, and because we build on your infrastructure they run under your standards and land in your audit trail. Static analysis with quality gates, SonarQube or Semgrep or your own equivalent, runs on every commit. Dependency and vulnerability scanning, Snyk or Dependabot, on every build, with continuous alerts on newly disclosed CVEs. Secrets scanning with push protection in CI and before commit, GitHub secret scanning or gitleaks. A software bill of materials and licence provenance checks for anything we ship, so AI-generated code arrives with its supply chain documented. Protected main branches and human code review before merge, with a model-led security review of the whole system roughly every fifth prompt during a build. Independent penetration testing in the productionisation phase, scoped to the code that shipped.

Our engineers work inside client estates and client data. The rules below govern every AI tool that touches them. No client data, code or documentation goes into any AI tool that has not been named and approved by you in writing. Where you have an approved enterprise AI tenancy, we work inside it rather than bringing our own. Where you have no approved tenancy, the default toolchain is named for your review: Anthropic's Claude Code, OpenAI's models and Google's Gemini, combined for what each does best, running inside your infrastructure and aligned to your policies, and substituted for your approved stack on request. We use zero-retention or enterprise agreements with model providers so client content is not retained or used for training. Agentic systems we build for you are designed with action logging, human-in-the-loop approval gates for consequential or irreversible decisions, and an auditable trail from decision to outcome. Model and agent risk is documented during operating model design, with your second-line risk function as a co-author rather than a reviewer.

What your procurement, legal and risk teams will ask for. All of it is available during supplier onboarding. Master Services Agreement and Statement of Work templates. Data Processing Agreement including sub-processor annex, UK IDTA or EU SCCs, and Article 28 change-notice terms. Professional indemnity, public liability, employers' liability, cyber and legal expenses certificates, with the cover levels listed on this page. Liability cap agreed per engagement in the SOW, with breach of confidentiality and data protection treated separately. You own all deliverables and any code written in your environment, on payment. 30 days' notice on retainers, with a documented handover on exit.

Our own estate is small, because we deliberately hold very little. This site is a static marketing site with no customer accounts and no client data on it. Statically generated and served over TLS with HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy headers set. No client data, no accounts and no authenticated area; the visitor-analytics estate is disclosed in full in our Privacy Policy. Third-party processors used by this site are listed individually in our Privacy Policy. Multi-factor authentication is enforced on every business system we operate.

Professional indemnity £1,000,000, Employers' liability £10,000,000, Public liability £1,000,000, Cyber £25,000, Legal expenses £100,000. Certificates are available during supplier onboarding. Where your supplier standard sets specific limits, any line can be increased for the engagement and the additional premium priced into it. Raise it on the first call and the increased cover, its cost and its lead time are agreed before contract signature. We hold no client production data and work inside your estate under your controls, which is what limits the exposure these lines answer for. Liability is capped per engagement in the Statement of Work, with breach of confidentiality and data protection treated separately.

Held today: UK GDPR and Data Protection Act 2018 compliant, as a UK-registered company; DPA with sub-processor annex available for every engagement; 24-hour personal data breach notification, committed in the Data Processing Agreement; UK data processing by default, with EU residency available where an engagement requires it; Engagement sub-processor list published on the security page and annexed to the DPA; BS7858-standard personnel screening before client access; No-substitution commitment written into the SOW: the people on an engagement are not changed without the client's written agreement; Named-tool-only policy for AI systems touching client data; Professional indemnity £1m, employers' liability £10m, public liability £1m, cyber £25k, legal expenses £100k. In progress: Cyber Essentials Plus: certification in progress; ISO 27001: gap assessment complete, certification targeted for 2027; ISO/IEC 42001 (AI management systems), under assessment, and increasingly the one clients ask for; SOC 2 Type II: will follow ISO 27001 where clients require it. Everything in the held list can be evidenced during supplier onboarding. Nothing in the in-progress list is certified yet.