Our commitment

Security is a condition of being trusted with anyone's data. We apply proportionate, standards-aligned controls and we assume breach rather than assume safety.

Core controls

• Multi-factor authentication on all business accounts
• Least-privilege access, reviewed when roles change and revoked on the last working day
• Encryption in transit and at rest for systems holding personal data
• Managed devices with disk encryption, screen lock and automatic updates
• Password manager required; no shared credentials
• Logging and monitoring on production systems, with backups tested regularly

Third parties

Vendors handling our data are assessed before onboarding and bound by written terms covering security, sub-processing and breach notification.

Incidents

Suspected incidents are reported immediately to contact@equityhouse.io. We contain, assess, notify where required, and record lessons learned in a written post-incident review.

Governance and review

This policy is owned by the Head of Technology and approved by the board. It is reviewed at least annually, and sooner if the law, our operations or our risk profile changes.