INFORMATION SECURITY AND CLIENT ASSURANCE
Client suitability depends on the data sensitivity and actual assignment. Assurance is assessed before confidential information is accepted.
Founder-only Cloudflare Access applications, private R2 bucket with public access disabled, per-matter D1 access grants and an append-only operational event register. This describes the current architecture, not completed external-client security certification.
Synthetic uploads have passed file-integrity and lifecycle testing. Separate controls identify data classes, designated reviewers, outstanding evidence and versions. Real confidential file upload into the proprietary portal is currently disabled.
Only non-confidential business enquiries are accepted through the public form. Client documents require approved terms, authorised recipients, a vetted transfer environment, appropriate retention and incident handling.
Policies are being mapped to UK GDPR accountability expectations, NCSC Cyber Essentials baseline controls and relevant ISO/IEC 27001 information-security management practices. Internal policy preparation is not independent certification.
External-client negative-access acceptance, malicious-file scanning, isolated restore drills, approved high-sensitivity transfer workflows, contract-specific subprocessor disclosures and insurer/buyer assurance checks. No ISO 27001 certificate, Cyber Essentials certificate, SRA authorisation or general security accreditation is claimed.
Professional buyers may request a data-processing schedule, access/control summary, retention table, incident reporting procedure, subprocessors and evidence register. The response will distinguish operating controls from planned controls and provide only authentic evidence. Request a non-confidential supplier assurance pack through the business enquiry channel.
The independent practice delivers non-reserved operations and evidence support. It does not replace a client's regulated law firm, lender, valuer, surveyor, insurance intermediary or statutory decision-maker.