Security statement

Our approach

Protego applies risk-based security controls to its own corporate systems and to the environments used to deliver client work. Controls are selected according to the information held, contractual requirements and the consequences of loss, alteration or unavailable systems.

Core controls

• +Access is granted by role, approved by an accountable owner, reviewed periodically and removed when no longer required.
• +Multi-factor authentication is required for business systems where the service supports it, with stronger controls for privileged access.
• +Managed devices use current security configuration, encryption, endpoint protection and update controls.
• +Data is encrypted in transit and, where supported by the service, at rest. Client material is separated and shared on a need-to-know basis.
• +Suppliers are assessed in proportion to access and impact, with security and data-protection terms included where appropriate.
• +Security-relevant activity is logged and reviewed according to risk. Alerts and vulnerabilities are triaged, assigned and tracked to closure.
• +An incident response process defines escalation, containment, communication, recovery and lessons learned. Exercises are used to test it.

Certifications and assurance

Protego does not currently claim external certifications. Certification details will be published here only after they have been verified. Penetration testing is delivered in house by our own tester. Certification bodies and partner-delivered specialist work are named before work begins.

Reporting a concern

Report a suspected vulnerability or security concern to security@protegosol.com. Researchers should follow our responsible disclosure policy so we can investigate safely.