Our role
On a client engagement you are almost always the controller and we act as a processor. Our obligations are set out in a written data processing agreement that forms part of the engagement contract and covers purpose limitation, confidentiality, security measures, sub-processors, assistance with subject rights, breach notification timescales and deletion or return of data at the end.
We do not use client data for any purpose of our own. We do not use it to train models, to build benchmarks, or to produce case study figures without written permission and anonymisation.
How we work with your data in practice
- Inside your tenant. We work in your environment under your conditional-access policies using named accounts. We do not use shared credentials, and we do not copy data to our own infrastructure unless you ask us to and the agreement permits it.
- Masked or subset data during development. Wherever it is feasible, development and testing use pseudonymised or subset data, with production access limited to validation and go-live.
- Least privilege, time-boxed. Access is requested at the minimum level needed for the current phase and revoked at the end of it rather than at the end of the engagement.
- No local copies. Engineers do not hold extracts on personal devices. Where an export is genuinely required for debugging, it is created inside your environment and deleted on completion.
Data residency across our markets
Residency questions come up on nearly every engagement, and the honest answer differs by country. We document the position per service rather than making a tenant-wide claim, because feature availability varies by region.
| Market | Regions normally used | Supervisory authority |
|---|---|---|
| United Kingdom | UK South (London), UK West (Cardiff) | the Information Commissioner's Office (ICO) |
| Ireland | North Europe (Dublin) | the Data Protection Commission (DPC) |
| Germany | Germany West Central (Frankfurt), Germany North (Berlin) | the federal commissioner (BfDI) and the Land data protection authorities |
| Switzerland | Switzerland North (Zurich), Switzerland West (Geneva) | the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) |
| Belgium | West Europe (Netherlands), France Central (Paris) | the Data Protection Authority (APD / GBA) |
Residency alone rarely satisfies a data protection officer or a works council. They will also ask about the processor chain and about access by vendor support personnel, so we prepare those answers during design rather than during an approval meeting.
Security measures
- Multi-factor authentication on every account that touches a client environment, with no exceptions for convenience.
- Device encryption, automatic patching and endpoint protection on all engineer devices.
- Secrets in a managed vault, never in source control, never in a pipeline parameter in clear text.
- Source control with reviewed changes for anything that will run in a production environment.
- Background checks and confidentiality undertakings for engineers working on regulated engagements, where the client requires them.
- An incident process with a named contact and a commitment to notify you without undue delay, and in any case within the period agreed in the contract.
Sub-processors
We keep the list short and disclose it before an engagement starts: our collaboration and email platform, our source control and CI provider, and nothing else that would touch client data. We notify clients in advance of any change and accept a reasonable right of objection.
Helping with subject rights
Analytics estates are where subject access and erasure requests usually become painful, because nobody maintains a map of which copies exist. Part of what we build is that map: lineage from source system to report, so a request can be answered against the estate rather than by investigation. Where erasure affects a warehouse, we implement it as a documented process rather than an ad-hoc deletion.
Sector-specific obligations
Several of our markets add requirements beyond GDPR, FINMA outsourcing expectations in Switzerland, BaFin and works council co-determination in Germany, regional obligations in Belgium, and Central Bank outsourcing rules in Ireland. We cover these per market on the locations pages and per sector on the industries pages.
Questions and contact
Supplier due diligence, security questionnaires and DPA review go through the contact form, which reaches the person who answers them. We would rather answer a long questionnaire properly than be approved on a short one.
We are not a law firm. Your DPO or counsel owns the legal position; we build and document the controls that support it.