For security, compliance and procurement teams

Security

This page is for the teams who review a new supplier. We send a supplier assurance pack before the first meeting, under NDA if you prefer.

ASSURANCE PACK

Information security policy

Latest penetration test summary

Data processing agreement

Business continuity and disaster recovery plan

Accessibility statement

AI governance policy

Your controls

We work inside your controls

We work in your cloud tenancy, with your identity provider and under your security policies.

We sign your NDA before the first call if you need one. Send us yours, or we can send ours.

We treat your regulatory and data protection obligations as design requirements from the first workshop.

Client portals

These settings are on before your security review starts. Turning a default off needs a written change request from you.

ENCRYPTION: Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256.
HOSTING: The portal runs in your cloud tenancy or ours, in the UK, EU or US region you choose.
IDENTITY: We connect to your identity provider, such as Microsoft Entra ID or Okta. Clients without one use passkeys or multi-factor authentication.
PERMISSIONS: Access is denied unless a rule grants it. Rules are set per client, per role and per document.
LOGGING: Audit logs are append-only, kept for the period you set and exported to your SIEM.
TESTING: An independent penetration test runs before every major release.
ACCESSIBILITY: Portals are built and tested against WCAG 2.2 level AA.

Agentic integrations

An action reaches your systems only after it has passed every layer. An agent that fails an evaluation stays out of production.

Each agent gets its own credentials, scoped to the systems and records its task needs.

Deterministic rules run before any action, covering limits, thresholds and required fields.

A named person approves the steps your risk policy specifies. You set the thresholds.

We test each agent against your historical cases before launch, and we keep testing it in production.

Every prompt, tool call, decision and approval is logged. Any run can be replayed.

Each agent comes with the documents your security, compliance and audit teams need before they approve it.

Vulnerabilities

If you find a security problem in this website or in a system we run, email hello@bewhitty.com. Our security.txt file has the same contact details.

A senior engineer will reply and send the pack, under NDA if you prefer.