Trust
How I handle your data
As an IT partner I get access to your environment. That is a position of trust. Here is how I deal with it.
How I work myself
Working securely
I use MFA on my own accounts, separate admin accounts and a password manager. I only use admin rights when needed.
Minimal access
I only ask for the permissions I need and have my access withdrawn afterwards.
Secured devices
I work on encrypted and up-to-date devices and do not leave client data on private devices.
Clearly documented
I put agreements about access, changes and data in writing, including a data processing agreement.
Data breaches
If I see a breach of personal data, I report it to you within 48 hours so that you can decide on further notifications.
AI tools
I use AI tools in my work, but I do not share data from your organisation without an agreement. By default I work with test data.
ISO 27001 as a guide
I work with ISO 27001, the international standard for information security, as a guide for my own policy: limiting access, recording risks and putting agreements in writing.
What I do not do
- I do not promise infallible security: security is a process, not a destination.
- I do not offer support outside agreed times.
- I do not earn from licences or devices I recommend, so my advice stays independent.
- I do not take on work I am not at home in, and I say so honestly.