Client data protection and confidentiality

Encrypted devices you can wipe from anywhere

Every laptop is enrolled in Microsoft Intune, encrypted, patched and checked for compliance. If one is lost or stolen, we can wipe it remotely. New laptops arrive through Windows Autopilot and set themselves up with those protections already applied.

Access by role, protected by MFA

People should reach the information their work needs and nothing more. That principle is called least privilege. We apply it to groups, shared mailboxes and document libraries, and we keep administrator rights to a small set of named accounts.

• MFA is enforced for everyone, and legacy sign-in methods are blocked.
• Conditional Access sets the rules for signing in, for example requiring a managed device.
• Every admin account is listed in your documentation register, which you can review at any time.

Sharing documents without losing control

Attachments get forwarded, saved to personal devices and kept forever. SharePoint and OneDrive let you share a link with a named person, set it to expire and withdraw it later. We set sharing up so that every external share is a deliberate choice.

Audit trails

Microsoft 365 records activity such as sign-ins and file access in its audit logs, kept for a period that depends on your licence. When a question comes up about who opened what, those records help answer it. Every change we make is also written into your documentation register.

Backup held outside your tenant

An independent Microsoft 365 backup sits outside your tenant, so a compromised admin account cannot delete it. Restores are tested on a schedule and reported monthly. More on backup and incident recovery.

For the full picture of how privilege and confidentiality shape the build, read how we protect confidentiality.