1. Principles
We process only the data needed for the agreed services, keep it accurate, limit access and delete it when no longer needed.
2. Marketplace access
We use only user-level permissions granted by the client. We do not accept passwords, two-factor codes or banking logins. Access is reviewed at onboarding and removed at offboarding.
3. Staff and confidentiality
Team members work under confidentiality obligations and receive access only to the client accounts they support. [VERIFY: confirm NDA and training practices].
4. Technical measures
Encrypted connections, environment-based secret management, rate limiting, form spam protection, hashed IP addresses in lead records and access logging.
5. Processors
We use vetted service providers under data processing agreements. A current list is available on request.
6. Data processing agreements
Clients who need a data processing agreement (for example under GDPR) can request one before onboarding.
7. Incidents
Suspected incidents are investigated promptly. Affected clients are informed without undue delay and regulators are notified where required.