Security and data handling, built in from day one.
Enterprise data programs come with real obligations around consent, access, and retention. Here's how those are handled across every engagement — described as practices, not claims we can't stand behind.
How your data is handled.
These practices apply across collection, annotation, and delivery — not bolted on after the fact for a compliance review.
NDAs & confidentiality workflows
Every engagement starts under a signed confidentiality agreement, with contributor-level NDAs added wherever your program requires them.
Role-based access
Access to your data is scoped to the people actually working on your program — not the wider organization.
Least-privilege access
Each contributor and reviewer sees only what their specific task requires, and nothing beyond it.
Secure workstations
Work is performed on managed devices with configured security controls, not on personal machines.
Encryption
Data is encrypted both in transit and at rest across collection, storage, and delivery.
Secure file transfer
Delivery moves through encrypted, access-controlled transfer channels rather than ad hoc file sharing.
Access logging
Who accessed what, and when, is recorded and available to review for the life of the engagement.
Device controls
Managed devices carry restrictions on copying, printing, and external storage to keep data from leaving the intended channel.
Data retention & deletion
Data is retained only as long as your engagement requires it, then deleted on a defined, documented schedule.
Incident response
A defined response process exists if something goes wrong, with your team notified directly rather than left to find out later.
Background verification, where applicable
Contributors working on sensitive or regulated data go through background verification appropriate to the engagement.
Consent is not optional.
Every participant is informed, every record is documented — specialized and regulated-adjacent projects get protocol-level rigor from day one.
Privacy & PII handling
Personal data is handled under defined protocols across the whole pipeline, not left to individual judgment case by case.
PII redaction
Personally identifiable information is identified and redacted wherever your program's specification calls for it.
Consent management
Consent status is tracked and documented for every participant in a data collection program, not assumed after the fact.
Participant consent
Every field participant is informed of what's being collected and why, before anything is captured.
Data-use disclosure
Participants are told how their data will be used, consistent with what your program has committed to.
Withdrawal mechanisms
Participants can withdraw consent, and their data is handled accordingly when they do.
What happens if something goes wrong.
Enterprise programs need more than a single point of failure. These are the practices that sit behind day-to-day delivery.
Business continuity
Programs are staffed and structured so that no single person leaving disrupts delivery to your team.
Disaster recovery
Data and infrastructure are backed up and recoverable in the event of an outage or system failure.
Vendor management
Any subcontracted or vendor relationship in your program is tracked and held to the same standard as our own team.
Security contact on every engagement
You get a named point of contact for security or compliance questions — not a shared inbox and a queue.
We don't display certifications we don't hold. If ISO 27001, SOC 2, or a specific compliance framework matters for your program, ask us directly what's currently in place and what we'd need to put in place for your engagement.
Have a security or compliance question?
Tell us what your program requires — we'll tell you exactly what's in place today.
Talk to Us →