Security and confidentiality
Agencies and consultancies get asked where the work is done, who touches the data and what happens if something goes wrong. This page is the answer, in a form you can forward. It describes what we actually do rather than what sounds reassuring.
We hold no security certification and do not claim one. Where a control is a practice rather than an audited standard, it is described as a practice. Send your security questionnaire with your enquiry and we will complete it as written.
The short answers
These are the lines that appear in almost every supplier assessment. The detail behind each one is below.
| Question | Our position |
|---|---|
| Do you hold ISO 27001, SOC 2 or an equivalent certification? | No. We hold no security certification and do not claim one. Everything on this page is a practice we run and will evidence on request. |
| Where does our data sit? | Wherever you keep it. We work in your systems, your repositories and your cloud accounts by default, so production data stays inside your boundary. |
| Who has access to it? | Only the named engineers on your engagement, at the access level you grant. Access is requested per person and removed when that person leaves the engagement. |
| Do you subcontract? | No, not without written agreement. Work is delivered by people employed by Insteller. Anything else is disclosed and approved before it happens. |
| Will you sign our agreement? | Yes. We sign your non-disclosure agreement, your data processing terms and your intellectual property assignment before an engineer is introduced. |
| Will you complete our security questionnaire? | Yes. Send it with the enquiry. We answer it as written and mark anything we cannot meet rather than working around the question. |
Data and access
The simplest way to protect client data is to avoid holding it. Our default operating model keeps production data inside the client estate and makes every action attributable to a named person.
The safest copy of your data is the one that never leaves your environment. Our default is to work inside your systems rather than take extracts.
Access is granted per person, at the least level that lets the work happen, and it is yours to give and take away.
On most engagements we are users inside your estate, which keeps the audit trail in one place: yours.
Building software
Review, secrets handling and environment separation are part of how work is built, not a checklist applied before release.
Security is handled where the code is written rather than inspected at the end of a project.
Credentials belong in a managed store, not in a repository, a ticket or a chat message.
Development, test and production are kept apart, and production access is the exception rather than the working default.
People and devices
Most supplier risk is people risk. Devices are controlled, confidentiality is contractual at both company and individual level, and the people on your engagement are our employees.
Work happens on company-controlled machines from our Galle office, configured before an engineer is given client access.
Confidentiality is contractual for the company and for every individual, and it is signed before anyone sees your systems.
You are entitled to know who is doing the work. Our position is that it is us, and that anything else is a decision you make.
When something goes wrong
Two commitments matter more than any control list: that you hear about a problem from us before you hear it elsewhere, and that an engagement does not depend on one person being available.
If something goes wrong on our side, you hear it from us, early, with what we know and what we do not.
A single delivery base is simpler to secure, so continuity is handled through redundancy in people, power and connectivity.
Scope of this page
Being precise about the limits is part of being credible about the rest.
A description of the practices we run on client engagements today, maintained as those practices change.
It is not a certification, an audit report or a contractual commitment on its own.
Security questions can go to info@insteller.comor through the enquiry form. Each engagement has a single named contact for security matters.
Supplier assessment
Attach it to your enquiry and we will complete it in your format, including the items we cannot meet. It is faster than working out from a web page whether we clear your bar.