Data Security

We apply a risk-based, defense-in-depth approach to information security and continually review our controls.

• Role-based access on a least-privilege, need-to-know basis.
• Confidentiality obligations for all staff and contractors.
• Security awareness training and acceptable-use requirements.
• Screening of personnel where lawful and appropriate.

• Encryption of data in transit and, where appropriate, at rest.
• Multi-factor authentication for access to key systems.
• Endpoint protection, patching, and secure configuration of devices.
• Logging and monitoring of access and activity on company and client systems.

Staff perform work on company-managed or approved devices in line with our security and acceptable-use requirements. Authorized workforce-management and monitoring tools are used for legitimate business purposes as described in our Activity & Time and Privacy policies.

Access is granted based on role, reviewed periodically, and promptly revoked when no longer required or when an engagement ends.

We select service providers that meet appropriate security standards and bind them to confidentiality and data-protection obligations.

We maintain procedures to detect, investigate, contain, and remediate security incidents, and will notify affected parties and authorities where required by law.

We maintain backups and continuity measures designed to restore critical services and data following disruption.

Clients are responsible for securing their own systems and credentials and for granting staff only the access needed to perform their role.

Security questions or to report a concern: support@lioncrestpeople.com.